chore(psr4): phase 0 — Composer PSR-4 autoloader foundation

Introduce a committed Composer PSR-4 autoloader without changing class
resolution behavior, as the foundation for the incremental PSR-4 migration.

- src/composer.json: PSR-4 (XcVm\ -> ./, M3uParser\, Chrisyue\PhpM3u8\),
  platform php 8.1.33 (deploy runtime), optimize-autoloader/classmap-authoritative
  false (live path resolution, no class-map cache). autoload.files left empty:
  global functions are still loaded by existing require glue; moving them is
  deferred until that glue is removed.
- src/vendor/ + src/composer.lock: committed (deploy path has no Composer);
  generated with 'composer update' from src/. Regenerate with dump-autoload.
- src/bootstrap.php, tests/bootstrap.php: require vendor/autoload.php first,
  then the legacy autoload.php.
- src/autoload.php: drop the igbinary disk cache (enableFileCache/saveCache/
  shutdown handler/root-chown + bottom call); register at the END of the SPL
  queue (prepend=false) so Composer wins for XcVm\* and only still-global
  classes fall through to the in-memory scanner.
- Makefile: add vendor to LB_DIRS so load-balancer archives ship the loader.
- phpstan.dist.neon: exclude src/vendor/* from analysis.
- .gitignore: document that src/vendor/ is intentionally tracked.
- ci.yml: add composer-audit job (no-op until real require deps exist).

Verified: php -l clean; Composer first / XC_Autoloader last in the SPL stack;
tmp/cache/autoload_map no longer written; PHPUnit 292/292; PHPStan no errors.

src/bootstrap.php

@@ -59,8 +59,11 @@ declare(strict_types=0);
 //  1. Class autoloader
 // ─────────────────────────────────────────────────────────────────
 
+// Composer PSR-4 autoloader first (resolves migrated XcVm\* classes), then the
+// legacy XC_Autoloader as an end-of-queue fallback for still-global classes.
+require_once __DIR__ . '/vendor/autoload.php';
 require_once __DIR__ . '/autoload.php';
-// After this: MAIN_HOME is defined, XC_Autoloader is initialized
+// After this: MAIN_HOME is defined, Composer + XC_Autoloader are registered
 
 
 // ─────────────────────────────────────────────────────────────────