chore(deps): require stable z-engine releases instead of dev branches

[lisachenko]

What

z-engine now ships stable tags for both supported PHP minors — 8.4.2 on the 8.4 line and 8.5.0 on the 8.5 line.

"lisachenko/z-engine": "8.4.x-dev || 8.5.x-dev" → "~8.4.2 || ~8.5.0".

What does not change: the root stability pair

"minimum-stability": "dev" / "prefer-stable": true stay. They are still needed — but for lisachenko/php-shared-data-extension, which has no tags yet and is consumed as dev-main, not for z-engine any more. The README used to attribute the requirement to z-engine; it now says which dependency actually needs it, so it can be dropped in one step once that package is tagged.

Resolution: confirmed stable

php-shared-data-extension published its own dev-only z-engine requirement, which Composer intersected with the constraint here and resolved to dev-master. That is fixed upstream — lisachenko/php-shared-data-extension#30 is merged — and resolution from Packagist now lands on the real tags with no path repository and no further change here:

PHP	z-engine resolved	shared-data
8.4.19	8.4.2	dev-main 45a7844
8.5.9	8.5.0	dev-main 45a7844

Why the tilde and not a caret

One z-engine release line per supported PHP minor: ~8.4.2 admits patch releases inside the 8.4 line but never the 8.5 line, ~8.5.0 the same for 8.5. A caret would span both lines and any future one, so a z-engine built for PHP 8.6 could be installed before this package claims to support 8.6. Each z-engine tag also declares its own platform requirement (~8.4.0 / ~8.5.0), so only one line can satisfy a given runtime, and Core::init() still enforces the exact match at boot.

Testing

Full .phpt suite on both minors, against the Packagist-resolved stable tags above:

PHP	z-engine	Result
8.4.19	8.4.2	121/121 pass
8.5.9	8.5.0	121/121 pass

Also ran earlier on PHP 8.5 against dev-master — the pre-merge resolution — 121/121. No segfaults, bus errors, hung children or stuck runtimes on any run; the fork, preemption and rendezvous tests all completed normally.

Note: PHPUnit could not be installed in the environment this was prepared in (egress is restricted to the lisachenko/* repositories, so Packagist dist archives for dev dependencies are unreachable). The .phpt files were executed by a runner that reproduces what PhptTestCase does — child process per file, the file's own --INI-- block plus display_errors=1, exact --EXPECT-- comparison, unanchored --EXPECTREGEX-- match. CI runs the real composer test on both minors.

Docs touched alongside: README.md (installation + requirements), AGENTS.md, the CI comment, and the spikes/README.md vendor-tree setup snippet, which no longer needs the minimum-stability/prefer-stable config calls to require z-engine. spikes/VERDICTS.md is left alone — it records what was measured at the time, against the commits named in it.