Use PHP for weekly dependency automation

[abnegate]

Summary

• Replace the weekly dependency updater and release orchestration from Python with typed PHP 8.3+ code.
• Keep stable same-major minor/patch updates for the PHP base digest and 13 extensions.
• Preserve exact-head CI gating, approval, squash-parent validation, resumable recovery, tag-build gating, and draft/redraft release safety.
• Keep the weekly Monday schedule and manual dispatch; publishing a release still triggers only the tag-based image build.

Validation

• PHP 8.3.32 and host PHP verification passed.
• PHPUnit: 142 tests / 1,790 assertions.
• All 91 parity contracts executed and passed.
• Pint scanned 96 PHP files; PHPStan max passed.
• Composer validation, audit, platform checks, actionlint, ShellCheck, and PHP lint passed.
• Live dry-run found eight eligible updates without mutating Dockerfile or status.
• Live recovery probe returned pending=false.
• Both final and xdebug Docker targets and runtime extension probes passed.