chore(deps): require stable z-engine releases instead of dev branches

[lisachenko]

What

z-engine now ships stable tags for both supported PHP minors — 8.4.2 on the 8.4 line and 8.5.0 on the 8.5 line — so this package no longer has to consume development branches.

• "lisachenko/z-engine": "8.4.x-dev || 8.5.x-dev" → "~8.4.2 || ~8.5.0"
• root "minimum-stability": "dev" / "prefer-stable": true dropped

Why the tilde and not a caret

The lockstep rule is unchanged: one z-engine release line per supported PHP minor. ~8.4.2 admits patch releases inside the 8.4 line (8.4.3, …) but never the 8.5 line; ~8.5.0 does the same for 8.5. A caret (^8.4) would span both lines and any future one, so a z-engine built for PHP 8.6 would become installable here before this package claims to support 8.6.

Resolution stays automatic and safe in both directions: each z-engine tag declares its own platform requirement (~8.4.0 for 8.4.x, ~8.5.0 for 8.5.x), so only one line can ever satisfy a given runtime, and Core::init() still enforces the exact match at boot.

Dropping the stability pair is now correct because nothing in require is a development branch any more — consumers no longer need minimum-stability: dev to install this package's dependencies. The install command in the README still asks for native-php-matrix:dev-master because this package itself is untagged; that explicit dev constraint carries its own stability flag and needs no root change.

Relationship to #12

#12 (closed) asked for exactly this once a stable z-engine tag existed, and listed three steps. Two are done here — relax the constraint, drop the root-stability note from the README. It suggested a caret; this uses a tilde per line instead, for the reason above — a caret would have re-opened the door the version guard exists to keep shut. Its third step, tagging a native-php-matrix release so the package is normally installable from Packagist, is still outstanding and out of scope here.

Docs updated alongside

• README.md — requirements + installation section
• CLAUDE.md — the non-negotiable version rule and the dependency policy (whose own "tighten this when z-engine ships stable releases" TODO this change discharges)
• .github/workflows/ci.yml — the explanatory comment above the job matrix
• .claude/agents/code-reviewer.md — its version-pin gate still described the older dev-master + "php": "~8.4.0" pins and would have rejected the current manifest

Testing

Both minors, functional suite, locally:

PHP	z-engine resolved	Result
8.4.19	8.4.2	19/19 .phpt pass
8.5.9	8.5.0	19/19 .phpt pass

No segfaults or bus errors on either minor. CI is green on all five jobs.

Note: PHPUnit could not be installed in the environment this was prepared in (egress is restricted to the lisachenko/* repositories, so Packagist dist archives for dev dependencies are unreachable). The .phpt files were executed by a runner that reproduces what PhptTestCase does — child process per file, the file's own --INI-- block plus display_errors=1, exact --EXPECT-- comparison, unanchored --EXPECTREGEX-- match. CI runs the real composer test on both minors.

Follow-up this unblocks (not in this PR)

Every .phpt carries error_reporting=E_ALL & ~E_DEPRECATED, added because z-engine's dev line declared implicitly nullable parameters (ZEngine\Type\OpLine::__construct()). The stable releases declare them ?Type, and the whole suite passes with error_reporting=E_ALL forced on both minors — so that suppression can now be removed from the 19 test files in a separate, purely mechanical change. CLAUDE.md is updated to record that it is belt-and-braces rather than a requirement.