feat(compat): emit stock PHP ini defaults to match v2 (#79)

[phramz]

Summary

Closes #79. Encodes the 12 ini keys that shivammathur/setup-php@v2 emits but our action currently doesn't, so the canonical-cell compat-diff gate from PR #77 clears without any allowlist suppression.

• 5 stock keys (expose_php, log_errors, max_input_time, session.save_handler, session.gc_maxlifetime) via new compat.StockIniDefaults
• 7 opcache keys (3 from v2 jit.ini + 4 stock opcache.* compiled-defaults) via new compat.OpcacheIniFragment, gated on PHP 8.x AND opcache being loaded; arch-aware on jit_buffer_size (256M x86_64 / 128M aarch64)
• xdebug.start_with_request=default added to the existing XdebugIniFragment

The compose pipeline grows from 3 layers to 5; compose.MergeCompatLayers is refactored to variadic so future layers don't churn the signature.

Spec

• docs/superpowers/specs/2026-04-27-stock-php-ini-defaults-design.md

Audit chain

docs/compat-matrix.md §2.1, §2.2, §2.3 extended with the new keys, each citing pinned upstream sources (PHP-8.4 SHA 171b722e…, v2 SHA accd6127…). Notes recorded for two nuances surfaced during the audit: max_input_time=-1 reflects the CLI-SAPI compiled-in default (overrides php.ini-production's literal 60 because the directive is PHP_INI_PERDIR / FPM-CGI scoped); 4 of the 7 opcache keys originate from stock php.ini-production (commented in upstream) rather than v2's jit.ini, but ship together because the load-condition is identical.

Test plan

• make check passes (every commit, before push)
• internal/compat and internal/compose at 100% / 90.4% coverage; new functions unit-tested with goldens (stock_ini_defaults.golden, opcache_ini_fragment_{x86_64,aarch64}.golden)
• make ci-cell OS=noble ARCH=x86_64 PHP=8.4 green locally — all 10 fixtures including bare, coverage-pcov, ini-and-coverage, multi-ext, multi-ext-top10-84, multi-ext-hard4-84
• No kind: ignore allowlist entries added to docs/compat-matrix.md
• CI canonical cell green
• compat-report sticky comment shows "cleared" (or empty) on canonical cell

PHPRC sanity probe (orthogonal, non-blocking — Task 7 of plan)

The local make ci-cell harness doesn't surface php --ini per-fixture, so the probe was inconclusive on whether PHPRC=<core>/usr/local/lib/php.ini actually loads the bundled php.ini-production at runtime. The encode-in-Go approach makes this orthogonal — the gate cleared regardless. Not filing a separate issue since there's no observable bug; if the bundled php.ini is later confirmed to be dead code at runtime it can be revisited.