Test on PHP 8.4/8.5 and run lowest deps on every PHP version

[snapshotpl]

Summary

• Extends the CI matrix to PHP 8.0–8.5, each with both highest and lowest dependency resolution, and removes the lowest excludes for 8.1–8.3.
• Makes the lowest jobs pass everywhere by pinning require-dev floors to releases that run on the whole 8.0–8.5 range: phpunit ^9.6.19, vfsstream ^1.6.12, var-dumper ^5.4.48, laminas-diactoros ^2.18.1 || ^3.0 (2.x tops out at PHP 8.3, so 8.4/8.5 resolve to 3.x). Packages with upper-bounded per-release php constraints (laminas, mezzio) resolve per platform on their own and needed no changes.
• Migrates the framework test from Slim 3 to Slim 4 (^4.15.2, supports PHP 7.4–8.5). Slim 3 cannot cover the matrix: 3.12.5 emits deprecations on PHP 8.1+ that land in the output buffer and make App::run() throw Unexpected data in output buffer, while 3.13.0 requires PHP ^8.1 and would exclude the 8.0 jobs.
• Slim 3 stays supported at runtime: extractPath() now duck-types the Slim\Http\Uri::getBasePath() quirk via method_exists instead of instanceof, so PHPStan no longer needs the class from slim/slim 3. The branch is covered by a new unit test using SlimUriStub; the double-pass __invoke() path was already covered by testTwoPassCallingForCompatibility.
• README: adds a Slim 4 install section, updates the tested-frameworks list.

Test plan

Verified locally in Docker (php:X.Y-cli + composer):

• PHP 8.0 --prefer-lowest — OK (31 tests, 80 assertions)
• PHP 8.4 --prefer-lowest — OK
• PHP 8.5 --prefer-lowest — OK
• PHP 8.5 highest — OK
• PHPStan level 6 on src/ (PHP 8.0, highest) — no errors

Note: on PHP 8.4/8.5 lowest, maximebf/debugbar 1.19 prints one harmless implicit-nullable deprecation (DebugBar::setStorage()); fixing that would require raising the production require floor, so it is left as-is.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QCFRdzoTxAMkVqfBK13Z4U