Make the public PHP quickstart contract consumer-resolvable

[rmcdaniel]

Problem

The deployed machine-readable PHP quickstart contract at https://php.durable-workflow.com/quickstart-contract.json exposes example source values such as examples/bootstrap.php and a published-smoke value under .github/workflows/. The schema does not define a resolution base or distinguish installed-package paths from public resources. Resolving those values against the deployed contract returns 404, so an agent or tool must infer repository layout and internal CI structure to use what is advertised as a public contract.

Acceptance criteria

• Define versioned resolution semantics for every source and evidence reference in the public quickstart contract.
• A consumer using only the deployed contract can locate the exact published bootstrap, worker, and client sources without a repository checkout or guessed URL base. A package coordinate plus package-relative path is acceptable when the schema explicitly declares that reference kind and immutable package version.
• Remove the repository-local workflow path from the public product contract, or replace it with a documented public qualification-evidence identity that consumers can resolve without knowing CI file layout.
• Deployment qualification fetches the public contract and proves all externally advertised references are consumable; keep checks structural rather than freezing prose or Markdown.
• Preserve the single release-owned PHP SDK version source and the existing Cloud and Server quickstart behavior.

Complete when

The deployed contract lets a fresh external consumer locate the exact published example sources and understand qualification provenance using only documented contract fields, with no unresolved repository-local implementation paths.