chore(deps): require stable z-engine releases instead of dev branches

[lisachenko]

What

z-engine now ships stable tags for both supported PHP minors — 8.4.2 on the 8.4 line and 8.5.0 on the 8.5 line — so this package no longer has to consume development branches.

• "lisachenko/z-engine": "8.4.x-dev || 8.5.x-dev" → "~8.4.2 || ~8.5.0"
• root "minimum-stability": "dev" / "prefer-stable": true dropped
• the repositories VCS entry pointing at the z-engine GitHub repo dropped — it existed to reach the development branches directly, and every version this package now accepts is on Packagist (verified by installing with the entry removed on both minors)

Why the tilde and not a caret

One z-engine release line per supported PHP minor: ~8.4.2 admits patch releases inside the 8.4 line but never the 8.5 line, and ~8.5.0 does the same for 8.5. A caret would span both lines and any future one, so a z-engine built for PHP 8.6 could be installed here before this package claims to support 8.6.

Resolution stays automatic: each z-engine tag declares its own platform requirement (~8.4.0 for 8.4.x, ~8.5.0 for 8.5.x), so only one line can satisfy a given runtime, and Core::init() still enforces the exact match at boot.

Downstream note

native-php-coroutines consumes this package as dev-main and cannot reach a stable z-engine until this lands: its own ~8.4.2 || ~8.5.0 constraint is currently intersected with the dev-only requirement published here, which forces dev-master. Once this is merged, the coroutines PR resolves the real tags with no further change (verified locally against this branch through a path repository).

Testing

The full suite on both minors, including the forked IPC, arena and registry tests:

PHP	z-engine resolved	Result
8.4.19	8.4.2	190/190 pass
8.5.9	8.5.0	190/190 pass

No segfaults, bus errors or hung children on either minor.

Note: PHPUnit itself could not be installed in the environment this was prepared in (egress is restricted to the lisachenko/* repositories, so Packagist dist archives for dev dependencies are unreachable). The suite was executed through a small stand-in that provides the TestCase assertion surface these tests use — assertSame/assertTrue/expectException/expectExceptionMessageMatches/DataProvider/RequiresPhpExtension and friends — driving the real test classes and the real tests/bootstrap.php. It does not implement PHPUnit's risky-test detection or failOnWarning, so CI's vendor/bin/phpunit remains the authoritative run.

---

Generated by Claude Code