re #96 burn down PHPStan level-6 baseline (72 -> 11)

[tonydspaniard]

Summary

Continues #96 toward an empty baseline. Fixes 69 of the 80 grandfathered level-6 findings at root cause — no @phpstan-ignore, no type-widening-to-silence, no baseline tricks. phpstan-baseline.neon shrinks 72 → 11 entries.

Work was parallelized: sub-agents fixed the independent packages (Http, Validation, Security, Session, Sanitation, Courier, Doctor, Events, Happen, Introspection, Scaffold); the coupled/design-heavy slice (Cache, Common, Container, Structure) was done directly. Every change verified centrally.

Notable real bugs fixed (not just annotations)

• HttpStatusCollection int/string confusion (substr on an int, impossible instanceof, unreachable code).
• FilesystemCacheItemStorage: the Windows path-length guard was '\\' === '/' — always false, so it never fired. Now DIRECTORY_SEPARATOR === '\\'.
• Predis: cluster classes moved to Predis\Connection\Cluster\* in predis 2.x (code imported the removed Aggregate\*); also removed dead 0 >= $lifespan branches.
• CreditCard/Ip/Isbn rules did arithmetic on strings; Session gc() returned void/true instead of int|false.
• Executable narrowed to ReflectionFunction|ReflectionMethod (only concrete subtypes), fixing invokeArgs()/invokeClosure().
• Arr::getValue typed mixed (it genuinely handles array|object|other and recurses on mixed) — also fixes a latent nested-access TypeError.

Dead code / precision

Redundant is_array/is_string/method_exists guards, always-false branches, redundant array_values, unnecessary nullsafe removed. SequenceTrait::adjustCapacity() is now abstract instead of method_exists-guarded; PriorityNode uses native int + constructor promotion.

Remaining 11 (decision-gated, follow-up)

• 8 trait.unused — public-API mixins (Data entity traits, etc.) exercised only by test fixtures, which PHPStan doesn't analyze (adding tests/ to paths surfaces 1006 test-code findings — out of scope).
• 2 Cookie collection generics — CookieCollection/SetCookieCollection diverge from Map<string, Cookie> (values() returns string cookie values), so no @extends binding is LSP-valid without a compose-vs-extend refactor.
• 1 Cycle getRepository template — third-party class-string<T>|non-empty-string|T union prevents template inference; result is pinned via @var.

Test plan

• composer cs — clean
• composer stan (PHPStan 2.1, baseline 11) — [OK] No errors
• vendor/bin/rector process --dry-run (full) — clean
• composer test — 5555 tests; only pre-existing local MongoSessionHandlerTest env errors (CI loads ext-mongodb)