feat(pathwise): prepare Pathwise 4.0 hardened runtime

[abmmhasan]

Pathwise 4.0 — release candidate

This PR is the completed Pathwise 4.0 major-release hardening and Foundation 3 / Point 26.5 lower-layer handoff.

Runtime architecture

• instance-scoped StorageContext for named filesystems, defaults, custom drivers, logical paths and local-path capability
• UploadProcessor / DownloadProcessor can use an injected StorageContext without process-global mounts
• redundant global storage-registry/facade mount topology removed; StorageFactory is stateless
• typed UploadSource ownership/materialization with deterministic private staging cleanup
• prepared range-aware iterable downloads with exact byte accounting and deterministic resource closure
• generic root-contained safe symlink management

Upload and malware security

• MalwareScanMode: OFF, default WHEN_CONFIGURED, REQUIRED
• typed MalwareScannerInterface, MalwareScanRequest, MalwareScanVerdict, provider/status diagnostics
• only explicit CLEAN passes a scan; all other verdicts fail closed
• Pathwise-owned private local scan copies, authoritative size checks and mutation detection
• malware scan occurs before MIME/signature/image parsing
• native bounded clamd INSTREAM adapter; recommended Linux deployment supports ClamAV with LMD signatures without requiring PHP/root maldet execution

Filesystem/runtime hardening

• deny-by-default policy engine
• truthful local-only atomic replacement; adapter-backed writes are staged but not mislabelled atomic
• bounded native execution with typed timeout/output/unsupported failures
• capability-based Windows behavior: AUTO uses portable PHP paths when native guarantees are unavailable
• unique queue leases with renew/ack/release/fail, stale-worker rejection and crash-safe state persistence
• hardened ZIP manifest/extraction, traversal/collision/special-entry/resource-limit enforcement and rollback
• durable/private audit, retention, indexing, watcher and transaction-state handling
• direct production psr/log ^3.0.2

Documentation and release gates

• complete Pathwise 4 user docs, migration guide, API/error reference, security model and performance/portability guidance
• Sphinx builds with warnings as errors
• dedicated Pathwise 4 release benchmark suite
• dedicated release-stress gate
• PHP 8.4/8.5 stable + lowest QA green
• PHPStan/Psalm green on PHP 8.4/8.5
• Windows PHP 8.4/8.5 relevant filesystem tests green
• optional adapter contracts green
• clean composer install --no-dev green
• release benchmarks PHP 8.4/8.5 green
• release stress green
• all inline code-scanning/review threads resolved

The implementation development plan has been removed now that the release gates are complete. Foundation's canonical runtime plan has been updated separately to consume Pathwise ^4.0 after the package release and remove Foundation's duplicated mount/upload/range/symlink mechanics.