chore(deps): require stable z-engine releases instead of dev branches

[lisachenko]

What

z-engine now ships stable tags for both supported PHP minors — 8.4.2 on the 8.4 line and 8.5.0 on the 8.5 line — so this package no longer has to consume development branches.

"lisachenko/z-engine": "8.4.x-dev || 8.5.x-dev" → "~8.4.2 || ~8.5.0", with README, AGENTS.md, CONTRIBUTING.md and the CI comment updated to describe release lines rather than "the 8.4 branch and master".

Why the tilde and not a caret

Rule 1 in AGENTS.md is unchanged: one z-engine release line per supported PHP minor. ~8.4.2 admits patch releases inside the 8.4 line but never the 8.5 line, and ~8.5.0 does the same for 8.5. A caret would span both lines and any future one, so a z-engine built for PHP 8.6 could be installed here — which would quietly turn "8.6 nightly installs but cannot touch the engine" into "8.6 nightly installs an engine binding that does not match the runtime".

Resolution stays automatic: each z-engine tag declares its own platform requirement (~8.4.0 for 8.4.x, ~8.5.0 for 8.5.x), so only one line can satisfy a given runtime, and Core::init() still enforces the exact match at boot.

This package never carried root minimum-stability / prefer-stable — an explicit dev constraint in require supplies its own stability flag — so nothing else in the manifest changes. What does change for consumers: composer require --dev lisachenko/userland-php-generics no longer drags a moving branch into their tree.

Testing

Engine suite (tests/, minus tests/PHPStan/), both minors:

PHP	z-engine resolved	Result
8.4.19	8.4.2	164/164 pass
8.5.9	8.5.0	164/164 pass

No segfaults or bus errors on either minor.

Notes on the local run: PHPUnit and PHPStan could not be installed in the environment this was prepared in (egress is restricted to the lisachenko/* repositories, so Packagist dist archives for dev dependencies are unreachable). The engine suite was executed through a small stand-in providing the TestCase surface these tests use — expectException/expectExceptionMessage, DataProvider, Before, RequiresPhpExtension, Group exclusion — driving the real test classes and the real tests/bootstrap.php with zend.assertions=1, so the assert()-based checks inside the tests were live. Two things it could not cover, both of which CI runs: the analysis suite (tests/PHPStan/, needs phpstan/phpstan-testing), and the destructive internal group (composer test:internal). Neither depends on the constraint changed here, but they are unverified locally and worth watching in this PR's CI.

---

Generated by Claude Code