Keep PHP CI host launchers outside writable container mounts #344

The admitted PHP CI launcher exposes its repository root and complete host-wrapper state read-write to same-UID package/application code. Such code can replace the host php/Composer wrapper or its launcher target and substitute the next nominal verifier. Security placed activation on HOLD in shared297. No compromise is inferred.

Owner: sample-app. This applies to already-merged main 799df847137dafd3fb70968c94ae56609a313479 as well as the product-tuple draft #339, whose merge/publication is held. General has been notified that the existing exact runtime admission must be held/replaced. The host-Python isolation correction in #342 remains in place; this is the separate writable-control boundary.

Acceptance:

• Repository/control paths and the complete wrapper/state authority are read-only in PHP containers. Permit only named data/cache/output mounts needed by existing callers; keep PHP playground writes separate from host Python/Rust source.
• Preserve both PHP minors, every existing caller cell, immutable image identity, resource limits, environment/credential allowlist, fixed-APT checks, CA handoff and live Composer guard.
• Add marker-only overwrite/rename replacement controls that demonstrate the predecessor escape and refuse on corrected source. Prove intended data writes and the next genuine PHP/Composer verifier still work in actual retained PHP 8.4/8.5 images.
• Retain actual TLS accept/refuse controls, qualify the original app/audit/playground callers, obtain Security review and the corrected exact central runtime binding before activation.

Next action: General retains the unresolved admission decision. Sample-app preserves the stopped validation step and the #338/#339 merge/publication hold. Do not retry or port the blocked operation, perform further rolling tuple refreshes, or run qualification until there is a permitted, reviewed source path. The prepared 2bf6f2a metadata remains a recorded candidate. No human action is requested and no replacement source/admission is claimed; the existing published Sample remains delivered. Uncommitted implementation WIP is retained locally. The session-specific blocked step is recorded in this comment.