build: manage psalm and box via composer in tools/ instead of committed phars

[fain182]

This replaces the psalm and box phars committed in bin/ with two small composer projects, tools/psalm and tools/box, each with its own committed lock file.

Why. The phars are outside every update mechanism we have: nothing watches them, so psalm.phar has been stuck at the version committed in #450 and today it cannot even start on PHP >= 8.4 dev machines (its embedded requirements checker stops at 8.3). As composer projects the tools are now covered by Dependabot (two new entries in dependabot.yml), which also means security advisories for them are surfaced like for any other dependency. As a bonus, the repo stops accumulating multi-MB binary blobs in its git history on every tool update, and tool provenance moves from "binary committed by hand" to packages resolved from Packagist with a lock file.

Why this still avoids the problem #450 solved. Psalm was moved out of require-dev because its own dependencies (e.g. its nikic/php-parser) conflict with arkitect's. The tools/ directories keep that property: each tool has an isolated vendor tree, nothing is shared with the root project.

What changes. Tool versions are unchanged (psalm stays on 5.26, box was already at the latest 4.7), make psalm / make phar / make build keep working the same way (they run composer install -d tools/... first, a fast no-op when up to date), and the CI psalm step still runs on the 8.0 job. Platform pins in the tools' composer.json keep the lock files resolved for the oldest runtime each tool runs on in CI (8.0 for psalm, 8.2 for box). The .gitignore composer.lock pattern is anchored to the root so the tools' locks are tracked while the root lock stays uncommitted by design.

The upgrade to Psalm 6 is deliberately left out of this PR and will follow as a separate one (branch chore/upgrade-psalm-6), since it brings its own config decisions and code fixes.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.28%. Comparing base (32feab2) to head (ddb63c4).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #659   +/-   ##
=========================================
  Coverage     98.28%   98.28%           
  Complexity      737      737           
=========================================
  Files            94       94           
  Lines          2100     2100           
=========================================
  Hits           2064     2064           
  Misses           36       36           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.