fix(deps): PHPCS 3.13.6 security release and Renovate

[apermo]

Security fix

squizlabs/php_codesniffer is raised from ^3.13.5 to ^3.13.6 for
GHSA-hmqg-cxww-wqhq
/ CVE-2026-67434 (high). The Gitblame, Hgblame and Svnblame reports built shell commands from file names
without escaping, so scanning a file whose name contains shell metacharacters could execute attacker-controlled
commands on the scanning host. Runs on the default Full report are unaffected.

The floor is raised rather than only the lockfile refreshed, so consuming projects cannot resolve back to a
vulnerable version — same approach as 3.1.1.

Why it was not caught here

This repo had no security check of its own; the advisory only surfaced in a consuming project's CI. Renovate's
config has been in .github/renovate.json since March but has never produced a PR — no Dependency Dashboard
issue, no bot PRs. The config file alone does nothing; the GitHub App was never installed.

• Security Audit job runs composer audit --locked on pull requests and pushes, plus a Monday cron so
  advisories published against versions already in the lockfile surface without needing a code change.
• renovate.json tuned so that security updates raise the composer.json floor (rangeStrategy: bump) instead
  of only refreshing the lockfile, advisories come from OSV directly (no dependency on Dependabot alerts), and
  security PRs bypass the Monday window. Adds lockFileMaintenance for transitive updates and a three-day
  minimumReleaseAge before dev-dependency patches automerge.
• Commit templates drop the vendor prefix and version so bot subjects stay within the repo's 50-character limit
  (longest case renders at 49); versions move to the commit body and the PR table.
• Check Version Bump / Check CHANGELOG Entry are skipped for Renovate PRs. Both expect a release decision
  that dependency PRs do not carry, and their failure would permanently block the dev-dependency automerge that
  the config already requested.

Still required (cannot be done from here)

Install the Renovate GitHub App on the apermo org: https://github.com/apps/renovate — until then the config
stays inert and the weekly composer audit is the only safety net.

Verification

• composer audit --locked — no advisories
• composer test — 78 tests, 245 assertions, all passing
• composer analyse — no PHPStan errors
• renovate-config-validator (latest) — config valid, no warnings

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.87%. Comparing base (ee9c5c2) to head (b869ae2).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #123   +/-   ##
=========================================
  Coverage     93.87%   93.87%           
  Complexity      577      577           
=========================================
  Files            31       31           
  Lines          1599     1599           
=========================================
  Hits           1501     1501           
  Misses           98       98           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.