Isolate Composer under ~/.pv/composer

[munezaclovis]

Summary

• Composer is now fully contained under ~/.pv/composer/ — it never touches ~/.composer
• ~/.pv/bin/composer is a shim script (like the PHP shim) that sets COMPOSER_HOME and COMPOSER_CACHE_DIR, resolves the correct PHP version per-project, then execs the phar
• composer global require laravel/installer installs to ~/.pv/composer/vendor/bin/, which is now included in the PATH instructions
• FrankenPHP worker processes inherit COMPOSER_HOME/COMPOSER_CACHE_DIR via CaddyEnv() so runtime Composer calls (Statamic, Nova) are also isolated
• Selftest verifies composer config --global home returns the pv-managed directory
• Existing ~/.composer/auth.json and config.json are automatically migrated during pv install

What changed

File	Change
config/paths.go	Add ComposerDir, ComposerCacheDir, ComposerBinDir, ComposerPharPath; create dirs in EnsureDirs; add env vars to CaddyEnv
binaries/install.go	Save composer.phar to ~/.pv/data/ instead of ~/.pv/bin/
phpenv/shim.go	Add composerShimScript; WriteShims() now writes both php and composer shims
setup/shell.go	PATH instructions include ~/.pv/composer/vendor/bin
setup/selftest.go	Add checkComposerIsolation() to verify COMPOSER_HOME
setup/composer.go	New — MigrateComposerConfig() copies auth/config from ~/.composer
cmd/install.go	Call migration helper after writing shims

Test plan

• All existing tests pass (go test ./...)
• 13 new e2e tests in composer_e2e_test.go that invoke the real shim with a fake PHP binary:
  • COMPOSER_HOME and COMPOSER_CACHE_DIR are set correctly
  • composer.phar path is passed as first arg to PHP
  • All CLI args are forwarded (global require laravel/installer --dev)
  • PHP version resolves from global default, .pv-php, and composer.json
  • ~/.composer is never touched
  • External COMPOSER_HOME env is overridden by the shim
  • Graceful errors when no PHP version configured or binary missing
• 3 shim unit tests (both shims created, executable, contain expected paths)
• 5 migration tests (copies auth.json, config.json, skips if absent, doesn't overwrite, preserves 0600 perms)
• Updated path/env tests for new composer directories and CaddyEnv entries