PHP probe: observer-API extension + no-extension mode #78

Part of #51. A probe for PHP apps (Laravel, Symfony, WordPress, plain PHP-FPM), built on the shared contract in #73.

Two install levels:

1. No extension, pure PHP: auto_prepend_file=/opt/secfoo/probe/php/prepend.php.
   • Inventory (Runtime package inventory: loaded versions, drift and live advisories #68): Composer's vendor/composer/installed.json and InstalledVersions, marked loaded when the autoloader first resolves a class from that package.
   • Routes (Attribute runtime hits to live traffic (route, auth state) #69): Laravel Route::current()->uri(), the Symfony _route path, and a WordPress REST route, falling back to unknown.
2. Extension, for function hits: a small C extension using the PHP 8 observer API (zend_observer_fcall_register) that observes only the watched functions and methods (Build a vulnerable-function watchlist from advisories #52 notation Namespace\Class::method).

PHP-FPM model: requests are short and workers are recycled. Aggregate per worker in memory and flush to the sensor every N requests or seconds, plus at worker shutdown. Never write to the socket per call.

Must not: read arguments, superglobals or request bodies, or add a blocking call to the request path.

Done when: Laravel and Symfony sample apps on PHP-FPM pass the #73 conformance kit at both install levels, and the PR includes an overhead benchmark.