chore(psr4): phase 0 — Composer PSR-4 autoloader foundation

Introduce a committed Composer PSR-4 autoloader without changing class
resolution behavior, as the foundation for the incremental PSR-4 migration.

- src/composer.json: PSR-4 (XcVm\ -> ./, M3uParser\, Chrisyue\PhpM3u8\),
  platform php 8.1.33 (deploy runtime), optimize-autoloader/classmap-authoritative
  false (live path resolution, no class-map cache). autoload.files left empty:
  global functions are still loaded by existing require glue; moving them is
  deferred until that glue is removed.
- src/vendor/ + src/composer.lock: committed (deploy path has no Composer);
  generated with 'composer update' from src/. Regenerate with dump-autoload.
- src/bootstrap.php, tests/bootstrap.php: require vendor/autoload.php first,
  then the legacy autoload.php.
- src/autoload.php: drop the igbinary disk cache (enableFileCache/saveCache/
  shutdown handler/root-chown + bottom call); register at the END of the SPL
  queue (prepend=false) so Composer wins for XcVm\* and only still-global
  classes fall through to the in-memory scanner.
- Makefile: add vendor to LB_DIRS so load-balancer archives ship the loader.
- phpstan.dist.neon: exclude src/vendor/* from analysis.
- .gitignore: document that src/vendor/ is intentionally tracked.
- ci.yml: add composer-audit job (no-op until real require deps exist).

Verified: php -l clean; Composer first / XC_Autoloader last in the SPL stack;
tmp/cache/autoload_map no longer written; PHPUnit 292/292; PHPStan no errors.

.github/workflows/ci.yml

@@ -1,8 +1,10 @@
 name: CI
 
 # Quality gate: runs on every push and pull request.
-# The project has no Composer — tests run via the committed PHAR
-# (tools/.bin/phpunit.phar) and a custom autoloader (src/autoload.php).
+# Tests run via the committed PHAR (tools/.bin/phpunit.phar). Class loading uses
+# the committed Composer PSR-4 autoloader (src/vendor/) first, with the legacy
+# src/autoload.php scanner as an end-of-queue fallback. The deploy path ships
+# vendor/ as-is and never runs `composer install`.
 
 on:
   push:
@@ -48,6 +50,27 @@ jobs:
       - name: Run PHPStan
         run: make phpstan
 
+  composer-audit:
+    name: Composer Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+          tools: composer:v2
+
+      # Reads src/composer.lock and checks the dependency graph against the
+      # Packagist advisory database. Does NOT run `composer install` (vendor/
+      # is committed). A no-op while every dependency is path-mapped/vendored,
+      # but gates real `require` packages the moment any are added.
+      - name: Composer audit
+        run: composer audit --no-interaction --working-dir=src
+
   test:
     name: PHPUnit
     runs-on: ubuntu-latest