chore: upgrade dependencies, harden static analysis/test strictness, and add AGENTS.md

[rowan-m]

Overview

General maintenance and quality-control hardening for the 2.x (main) series, resolving all 16 Dependabot security advisories in dev dependencies, strengthening PHPUnit 13 and PHPStan 2.2 strictness, standardizing strict typing across src/ and examples/, and introducing AGENTS.md for AI contributors and maintainers.

---

What's Changed

1. Dependency Upgrades & Security Audit (composer.json, composer.lock, .github/workflows/php.yml)

• Upgraded all 41 direct and transitive dev dependencies (phpunit/phpunit 13.3.4, phpstan/phpstan 2.2.14, friendsofphp/php-cs-fixer 3.95.27, guzzlehttp/psr7 2.13.1, symfony/* 8.1.x), resolving all 16 Dependabot / composer audit security advisories.
• Added autoload-dev ("ReCaptcha\\": "tests/ReCaptcha") to composer.json.
• Updated GitHub Actions in .github/workflows/php.yml to the latest SHA-pinned versions (actions/checkout@v7.0.1, actions/cache@v6.1.0), added a composer audit step to CI, and removed -k from the Coveralls webhook curl call.

2. Test Suite Quality & Strict Coverage Metadata (phpunit.xml.dist, tests/ReCaptcha/)

• Enabled PHPUnit 13 strict execution and coverage flags in phpunit.xml.dist (beStrictAboutCoverageMetadata="true", beStrictAboutOutputDuringTests="true", failOnDeprecation="true", failOnEmptyTestSuite="true", failOnNotice="true", failOnRisky="true", failOnWarning="true", executionOrder="depends,defects").
• Replaced @coversNothing across all 6 test classes with explicit PHPUnit 13 #[CoversClass(...)] and #[UsesClass(...)] attributes, maintaining 100% class, method, and line coverage under strict coverage isolation.

3. Static Analysis & Linting Strictness (phpstan.neon, .php-cs-fixer.dist.php, src/, examples/)

• Installed and enabled phpstan/phpstan-phpunit and phpstan/phpstan-strict-rules alongside level: max, checkBenevolentUnionTypes, checkImplicitMixed, checkMissingCallableSignature, checkTooWideReturnTypesInProtectedAndPublicMethods, checkUninitializedProperties, reportUnmatchedIgnoredErrors, and treatPhpDocTypesAsCertain: false.
• Enforced 'declare_strict_types' => true in .php-cs-fixer.dist.php and added declare(strict_types=1); to src/autoload.php and all files in examples/.
• Standardized examples/recaptcha-v2-checkbox.php to use require_once __DIR__.'/../src/autoload.php'; for consistency with the rest of examples/.

4. Contributor & Maintainer Guide for AI Agents (AGENTS.md, .gitattributes)

• Added AGENTS.md documenting project boundaries, zero-runtime-dependency requirements, main (2.x) vs 1.x (1.5.x) branching/SemVer policies, roave/backward-compatibility-check rules, transport security/resource invariants, namespace-scoped function mocking patterns, and mandatory quality gates.
• Added /AGENTS.md export-ignore to .gitattributes.

[coveralls]

coverage: 100.0%. remained the same — chore/project-quality-and-maintenance into main