Stabilize tooling CI commands

[mehul0810]

Summary

• Adds the missing dev dependencies used by the existing Composer lint and test scripts, and switches those scripts to vendor/bin executables.
• Replaces the unresolved checkstyle annotation action usage with the supported cs2pr CLI installed by setup-php.
• Pins Composer platform resolution to PHP 8.1 so the lock file remains installable across the release CI matrix.
• Scopes PHPStan to plugin PHP entry points and src, adds a runtime bootstrap, and records the current baseline so new static-analysis errors are gated.
• Removes stale PHPUnit XML entries so the existing test suite runs without configuration warnings.
• Runs code-style CI against changed PHP files so release PRs are gated without forcing a full legacy formatting sweep.

Validation

• composer validate --no-check-all
• composer install --dry-run --no-scripts --no-interaction
• composer lint
• composer test
• composer phpstan
• ./vendor/bin/phpcs -s --no-cache --report-full phpstan-bootstrap.php
• git diff --check

Remaining

• composer check-cs now runs with a default target, but still fails on existing repo-wide PHPCS debt. This PR keeps full cleanup tracked by Pass Linting CI/CD #53 while making CI useful for changed PHP files.

Refs #53.

[github-actions]

Test on Playground
Test this pull request on the Playground