feat(workflow): the workflow method receives its stubs and its environment as arguments (#419)

[gplanchat]

Closes #419.

A workflow method receives its activity stubs and its environment as arguments, the way a controller receives its services:

/** @param ActivityStub<GreetingActivities> $greeting */
#[AsWorkflowMethod]
public function run(
    string $name,
    #[Activities(GreetingActivities::class)]
    ActivityStub $greeting,
    WorkflowEnvironment $env,
): string {
    return $env->await($greeting->greet($name));
}

What changes

Where	Change
WorkflowDefinitionLoader	Plans the arguments once in load(): WorkflowEnvironment by type, #[Activities] stubs through $env->activityStub(), everything else from the input by name. A replay only runs the plan. run(array $input) counts input parameters only.
WorkflowDefinitionLoader	Refuses at load(): an ActivityStub without #[Activities], #[Activities] on another type, a contract that does not exist or declares no #[AsActivityMethod].
inputParameters()	The one filter for injected parameters, used by workflowMethodParameters() (Nexus payload names), ChildWorkflowStub (through a new optional parameter list on StubArguments::toPayload()) and the PHPStan extension.
WorkflowPass (bundle)	Loads each tagged workflow at compile time, so a refused one fails the container compilation instead of the first worker.
durable-phpstan	ActivitiesParameterRule: durable.activities.contractMismatch when the @param ActivityStub<T> names another contract than the attribute, durable.activities.missingGeneric when it is missing. SchedulingMethodReflection drops injected parameters from a child workflow's entry method, and only there.
Docs	Getting started shows the argument form; the workflows page explains what Durable supplies (EN + FR); the durable-phpstan README documents both identifiers.

Constructor injection keeps working. It stays the form for a class implementing a contract interface: PHP does not let the implementation add required parameters to run().

Deviations from the first version of #419

Recorded in the issue:

• #[AsActivity] is optional on a contract, so validation checks for at least one #[AsActivityMethod] instead.
• No options: on the attribute: Duration and RetryLimit have private constructors, which attribute arguments cannot reach. A stub with options keeps $env->activityStub($contract, $options).
• Errors surface at container compilation, not cache:warmup.
• PHPStan has no non-failing level, so a missing docblock is an error with its own ignorable identifier.

Review

A fresh-context review found no blocker. Its findings are fixed in the last four commits:

• an input default built per execution rather than shared by a worker;
• the PHPStan rule reading ActivityStub<T>|null and #[Activities('Fqcn')];
• the stub-parameter filter limited to workflow methods;
• two missing tests (Nexus fulfilment, a contract that does not exist);
• documentation details.

Checks

• tests/unit/Durable, tests/unit/DurablePhpstan, tests/unit/DurableBundle/DependencyInjection: 880 tests, green. Every behaviour change arrived with its failing test first.
• Every commit is under 200 changed lines.
• loop/guardrails/verify.sh is red locally for a reason outside this diff. The local vendor/ lacks doctrine/orm and illuminate/cache, which breaks the Laravel, Illuminate and SchemaListener tests and five PHPStan findings in files this PR does not touch. The same failures occur on main. CI installs from the lock and is the reference.