ci: run PHPMD 3.0.0 with its analyze command

[erseco]

setup-php now installs PHPMD 3.0.0 (released 2026-10-04), which replaces the positional CLI with the analyze command. The current invocation fails with Command "." is not defined, writes no SARIF, and the upload step fails (seen on #56). main last passed on 2026-10-03 and will fail on its next run.

• Pin phpmd:3.0.0 so a future major does not break the scan silently.
• Use phpmd analyze . --format sarif --ruleset phpmd.xml --reportfile-sarif …, same ruleset and report.

The job already runs on PHP 8.5, so no php-version change is needed (PHPMD 3 needs 8.1+).

Verification: on main, PHPMD 3.0.0 analyze and 2.15.0 with the old CLI both produce 0 results with this ruleset; actionlint is clean.

Same fix as exelearning/omeka-s-exelearning#66.

[github-actions]

Test in WordPress Playground

Test the plugin with the code from this branch:

ℹ️ The eXeLearning editor is fetched from the shared release and unpacked into the plugin when the playground boots, so the first load may take a few extra seconds. ELP upload, shortcode, Gutenberg block and preview work normally.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.42%. Comparing base (985d3ca) to head (688be4e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #165   +/-   ##
=========================================
  Coverage     96.42%   96.42%           
  Complexity      806      806           
=========================================
  Files            36       36           
  Lines          4256     4256           
=========================================
  Hits           4104     4104           
  Misses          152      152           

Flag	Coverage Δ
javascript	95.81% <ø> (ø)
php	96.64% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1416bb8...688be4e. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.