fix(php): keep proven vendor types out of project name fallbacks

[DeusData]

PHP imports whose declared namespaces are absent from the indexed project can currently resolve constructors, inherited types, usages, and typed receiver calls to unrelated project symbols sharing a short name. This adds typed, per-file import evidence and uses it before PHP refinement and generic name fallback in both pipeline paths. Exact semantic targets and HTTP/ASYNC classification retain precedence.

Both PHP IMPORTS writers retain class/function/constant provenance, including same-alias bindings that share an edge. File evidence is accepted only when the full current import manifest and stored edges agree. Rebuilds invalidate the old completion marker before allocating replacement metadata. Namespace-map construction fails closed on detectable allocation or insertion failures so a partial map cannot prove absence. Borrowed evidence is released before result disposal or spill/reload. Binding arrays and namespace keys use tracked memory-core allocation and matching cleanup; existing FQN values and JSON writer buffers retain their allocator ownership. Sequential and parallel import paths share cleanup without increasing the raw-allocation baseline.

The absence proof is intentionally bounded. Missing namespace maps, overlong names, unresolved global/path imports, and covered-but-missing or empty-prefix PSR-4 imports leave the whole file unknown; resolved IMPORTS remain. Ordinary usage sites with genuinely ambiguous import kinds may remain unresolved. This does not claim full PHP import-kind coverage or complete resolution of #1186.

Adds regressions for known-empty versus unknown evidence, grouped import kinds and project positives, pre-refinement property/return/trait cases, same-occurrence stale results, service calls, and sequential/parallel spill parity.

Validation: UNRUN by explicit user waiver: local builds, tests, compiler/syntax checks, lint, sanitizers, benchmarks, revert proof, and CI. Changed-range formatting with clang-format 20, source/ownership review, and diff/byte/literal/hash integrity checks were performed. Runtime and lint confirmation are deferred to PR CI. Existing graphs need reindexing to obtain the new PHP import evidence.

Base: main. Depends on #2515 (the import-resolution prerequisite); this branch includes that prerequisite. Refs #1186.

[DeusData]

Checkpoint and handover (2026-10-03 UTC)

Published head: 6e2c18bfbff87d0611dceac419bc235a5e686169. The remote head was verified.

PHP vendor type handling is published with the allocator/ownership follow-up. Review covered target filtering, namespace keys tracked as OTHER, borrowed values and libc-owned allocations; the raw-allocation baseline was not relaxed. The earlier lint failure requires a fresh hosted result on this corrected head. Local lint/runtime verification was not run. Import prerequisites are #2509 and #2515.

Hosted snapshot at 2026-10-03 21:54:18 UTC: 3 queued. Confirm the required checks on this exact head before treating it as ready.

No additional local build, test, lint, sanitizer, benchmark or CI runs were performed at this checkpoint, as requested. Earlier executed evidence remains historical; prepared tests and the newer source-reviewed changes must still be validated by the hosted gate.

The campaign is paused at the maintainer’s request. Local monitoring has stopped; hosted jobs remain running. No merge was performed. Thanks for reviewing this change.