feat/strict php flag

[nahime0]

Summary

Adds a --strict-php compiler flag: the program is accepted only if it uses PHP-compatible constructs. Every elephc extension — syntax, builtins, and their eval() reachability — either becomes a compile error or behaves exactly as it would under the PHP interpreter (i.e., as if it did not exist).

What it does

Extension syntax is rejected at compile time. A dedicated AST audit (src/strict_php/audit.rs, exhaustive matches with no wildcard arms) reports every violation with its span: ifdef, packed class, extern declarations, ptr_cast<T>, buffer_new<T>, typed local declarations (int $x = 5;), ptr/buffer<T> type annotations, and compiler-reserved __elephc_* names. The audit runs on the main file and on every include/required and autoloaded user file at its parse site; compiler-injected preludes are exempt.

Extension builtins behave as nonexistent. ptr_*, zval_*, buffer_*, class_attribute_* (declared via a new extension flag in the builtin! registry) are hidden from the catalog: function_exists() returns false, calling one is an undefined function (the diagnostic names the disabled extension), and user code may declare its own functions with those names — matching PHP, where redeclaring them is legal. is_real is intentionally kept (treated as PHP).

eval() is covered with PHP's execute-time semantics. Strict binaries mark the magician bridge via a new __elephc_eval_set_strict_php FFI setter emitted at eval-context init; magician filters its extension set (raw-memory area + attribute introspection, pinned cross-registry) out of the single lookup choke point, so calls inside eval'd code hit the standard unknown-function fatal and function_exists/is_callable agree with the AOT surface. The AOT literal-eval classifiers route extension syntax to the bridge so nothing elephc-only is ever AOT-executed. Fragments are never rejected at compile time — PHP only fails eval'd code when it executes. User functions shadowing extension names stay callable from eval through the native table.

--define conflicts with the flag (defines only feed the rejected ifdef extension), and strict mode composes with --check.

Enabling changes

• buffer_len/buffer_free migrated from checker-resident arms to registry homes under src/builtins/pointers/ (messages and lowering preserved); buffer_new stays catalog-name-only since its call form is dedicated syntax.
• The image/web preludes now call internal: true __elephc_ptr_* aliases instead of PHP-visible pointer builtins, so the catalog filter needs no notion of code origin.

Guard rails

• EXPECTED_EXTENSION_BUILTINS pins the AOT extension set; extension_builtin_sets_agree_across_registries pins magician's derived set against it (minus static-only zval_*); preludes_never_call_php_visible_extension_builtins scans prelude sources.
• All filters are gated on the strict flag: default-mode behavior is unchanged (verified by the existing eval-dispatch, buffer, image, web, and parity suites).

Docs

CLI reference gains a “Strict PHP mode” section (scope, eval semantics, the --define conflict, and the caveat that strict guarantees PHP-compatible constructs, not full static-subset semantic parity); every docs/beyond-php/ page notes its rejection under the flag; new examples/strict-php/ runs identically under elephc --strict-php and the PHP interpreter; generated builtin docs regenerated.

Test plan

• 24 in-process error tests (audit rejections, hidden builtins + hint, shadowing, include auditing and the include-variant false-positive regression)
• 14 CLI end-to-end tests against the real binary, including both eval paths, introspection coherence, prelude programs, and --check/--define composition
• Magician unit tests (931 passing) and cross-registry/prelude parity gates
• Focused regression suites: buffers (28), pointers (38), image (165), eval dispatch (133), eval parity (18), IR smoke (255), full error suite (1071), lib (684) — all green, zero-warning build