Release v1.3.5

Release v1.3.5

PHPStan FrankenPHP rules (REQ-CS-005), empty baseline, type/DI hygiene.
Security checklist (12.4.1): SECURITY.md current; no secrets; composer audit clean; N/A crypto.

Changelog

Added

• REQ-CS-005 — nowo-tech/phpstan-frankenphp (classic + worker rulesets) in phpstan.neon.dist
• Empty phpstan-baseline.neon (ignoreErrors: []) included from PHPStan config

Changed

• PHPStan Level max hygiene: typed PHPDoc/generics, FQCN → use imports, inventory YAML cache as instance property
• DI — $useLogger bound explicitly on CookieConsentFormSubscriber (survives host setClass overrides; avoids unused global bind)
• PHP-CS-Fixer fully_qualified_strict_types.import_symbols enabled
• Dev lock refresh (PHPStan ecosystem, php-cs-fixer, demo locks)

Fixed

• CSRF deny on cookie definition delete throws AccessDeniedHttpException (consistent 403)

No configuration or public API breaking changes for bundle consumers.

Documentation

• UPGRADING.md — upgrade path from 1.3.4
• RELEASE.md — release history entry

Full Changelog: v1.3.4...v1.3.5