ci: fail on deprecations triggered by our own code

[jdreesen]

Summary

Picks up the idea of #44 (suppress only the deprecations we can't do anything about, instead of being blind to all of them), but with PHPUnit's own options instead of symfony/phpunit-bridge.

• New phpunit-strict.xml.dist: phpunit.xml.dist plus failOnDeprecation="true" and <source ignoreIndirectDeprecations="true">. Deprecations that only third-party code causes are ignored, the ones our own code or tests trigger fail the run. It needs PHPUnit 11.1+ (older versions report the unknown attribute as a configuration warning, which failOnWarning turns into a failure), so the default config stays as it is.
• CI: the jobs that run "highest" dependencies with the newest PHPUnit version of each Pimcore line use it: 11.5 / PHP 8.3 / ^12.5, 12.0 / PHP 8.4 / ^13.4, 2026.1 / PHP 8.4 / ^13.4 and 2026.1 / PHP 8.5 / ^13.4. They are flagged via strict in the matrix (two include entries that add no jobs) and show / strict deprecations in their name. "lowest" and PHPUnit 9/10 are unchanged: what we trigger depends on the Pimcore line, not on the PHPUnit version, and "lowest" only adds third-party noise.
• The tests of the deprecated BC layer are excluded from the strict config. Loading the deprecated classes triggers their deprecation before any test runs; PHPUnit 13 reports that without a trigger classification, so it can't be ignored. The other jobs still run these tests.
• New tests:strict composer script; CLAUDE.md and .gitattributes updated.

Findings behind it

• On "lowest" (Pimcore 2026, PHPUnit 13.4.0, 44 deprecations) every non-suppressed deprecation is classified as indirect: old transitive vendor code on a new PHP version. The strict config reduces that to zero, so no regex baseline is needed.
• With the strict config, deprecations triggered by our own code (a direct PHP deprecation and a trigger_error(E_USER_DEPRECATED) from a test, checked on PHPUnit 12 and 13) fail the run.
• PHPUnit's native baseline is line- and hash-exact, so it doesn't carry over between the "highest"/"lowest" dependency sets; that's why it isn't used here.

Test plan

• composer tests:strict locally with PHPUnit 13.4.1 and 12.5.38 (PHP 8.5, Pimcore 2026): 101 tests, 0 deprecations, exit code 0
• Probe tests (own direct and own user deprecation) fail with the strict config on PHPUnit 12 and 13
• Matrix expansion simulated: 39 jobs as before, exactly the four jobs above get strict
• CI: the four strict jobs are green and use phpunit-strict.xml.dist (101 tests, no deprecations), including Pimcore 11.5 and 12 that weren't run locally
• CI: all other jobs unchanged and green (43 checks; the non-strict PHPUnit 12 jobs still use phpunit.xml.dist)

🤖 Generated with Claude Code