fix(tests): eliminate uniqid() parallel-flake and PHP 8.5 setAccessible() deprecation

[markshust]

Summary

Two related test-suite hygiene fixes that surfaced during the 0.5.0 release run:

• Replace bare uniqid() with bin2hex(random_bytes(8)) across all 54 test files that used it for temp-directory naming. PHP's uniqid() is microtime-based and the docs explicitly warn it doesn't guarantee uniqueness without entropy — when pest runs with --parallel (10 worker processes), two workers can call uniqid() in the same microsecond, get the same string, and race on filesystem state.
• Remove three ReflectionProperty::setAccessible(true) calls in packages/core/tests/Unit/ApplicationTest.php. Deprecated in PHP 8.5 because reflection on private/protected properties has worked without it since PHP 8.1. The calls were no-ops emitting deprecation notices on every test run.

Why

During the 0.5.0 release attempt, ApplicationTest::"it calls module boot callbacks after bindings are registered" failed once in a parallel run with Failed asserting that false is true. The test passed in isolation and on the next parallel re-run. Root cause: two parallel workers got the same uniqid() value, used it for the same $baseDir = sys_get_temp_dir() . '/marko-test-' . $uniqueId, and one worker's appTestCleanupDirectory() wiped the other worker's module.php before $app->initialize() could load it — so the boot callback never fired and the asserted $GLOBALS flag stayed false.

This is a release-blocking issue: any future ./bin/release.sh run could hit the same flake and abort. Fixing once removes the class of failure entirely.

The deprecation cleanup is a small companion fix found while investigating — pest --display-deprecations showed the three setAccessible calls firing, and removing them brought the deprecation count from 2 → 0.

Fix Mechanics

uniqid() collisions:
```diff

• $baseDir = sys_get_temp_dir() . '/marko-test-' . uniqid();

• $baseDir = sys_get_temp_dir() . '/marko-test-' . bin2hex(random_bytes(8));
  ```

Same call shape, but bin2hex(random_bytes(8)) returns 16 hex chars of cryptographic entropy — effectively zero collision probability vs uniqid()'s microtime-derived 13 chars. Drop-in compatible with all use sites (opaque identifier in temp paths and namespace suffixes).

The single uniqid('test_', true) call in media-gd tests is left alone — it already includes the more_entropy argument.

setAccessible(true) removal: just delete the line. Since PHP 8.1, ReflectionProperty::getValue() on a private/protected property works without prior setAccessible(true).

Test plan

• Full destructive suite (pest -c phpunit.xml --parallel) run 3 times consecutively post-fix:
  • Run 1: 4898 passed, 0 failed, 0 deprecated, 138 notices, 2 skipped
  • Run 2: 4898 passed, 0 failed, 0 deprecated, 138 notices, 2 skipped
  • Run 3: 4898 passed, 0 failed, 0 deprecated, 138 notices, 2 skipped
• Pre-fix state: intermittent 1-test failure + persistent 2 deprecation notices
• No production code touched — packages/*/src/** untouched

🤖 Generated with Claude Code