Repair utility contracts and quality gates

[alexstandiford]

Summary

• restore the configured test, spellcheck, Composer, and level 9 static-analysis gates
• correct array replacement, pagination, object access, closure hashing, and processor validation behavior
• document truthful collection shapes and preserve PHP 7.4 compatibility at runtime
• make the legacy ItemNotFound class available through ordinary Composer autoloading
• refresh only the PHP 7.4-compatible vulnerable development dependency closure

Compatibility

Public native signatures remain unchanged except for Arr::get() key, which is intentionally widened from string to the existing array-key behavior used by integer-offset consumers. Mixed replace and replaceRecursive values remain supported. Comparable-value helpers accept bool, float, int, string, null, and objects with __toString() on PHP 7.4 and newer.

Verification

• clean Composer install
• composer validate --strict --no-check-publish
• composer audit --locked with zero advisories
• PHPUnit on PHP 8.3: 69 tests, 142 assertions
• PHPUnit on PHP 7.4: 69 tests, 142 assertions
• PHPStan level 9: zero findings
• locked dependency set compatible with PHP 7.4.33
• ordinary non-optimized Composer autoload resolves PHPNomad\Core\Exceptions\ItemNotFound
• focused mutations fail for each repaired behavioral guard