feat: validate extension attributes in the constructor

[Meldiron]

What

Extension attribute names and value types are now validated when a CloudEvent is constructed:

new CloudEvent(
    type: 'test.event',
    source: 'test-service',
    id: 'test-id',
    extensions: ['Trace_Parent' => 'value'], // throws InvalidArgumentException immediately
);

Why

Previously the constructor accepted any extensions array and the problem only surfaced when validate() happened to be called — an invalid event could travel through the system before failing. Since $extensions is readonly and every path into an instance (fromArray(), fromJson()) goes through the constructor, checking once at construction guarantees an instance never carries an invalid extension.

Notes

• The now-redundant checks in fromArray() and validate() are removed; fromArray() still treats null extension values as unset before constructing. Exception messages are unchanged, and the existing fromArray rejection tests pass as-is against the constructor-thrown exceptions.
• Behavior change: constructing with invalid extensions now throws immediately instead of at validate() time. The testValidateRejects*Extension* tests were reworked into their constructor-level equivalents (testConstructorRejectsInvalidExtensionName/ReservedExtensionName/InvalidExtensionValue).
• Follows the no-getters/no-withers convention: extensions are passed at construction and read via the readonly extensions property.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR moves extension-name and value-type validation into CloudEvent construction.

• Filters null extension values in fromArray() before construction.
• Removes the corresponding checks from validate().
• Updates constructor-level tests and documents immediate rejection of invalid extensions.

Confidence Score: 4/5

The PR is not yet safe to merge because native unserialization can still produce a CloudEvent whose invalid extensions are accepted by validate().

PHP native unserialization bypasses the constructor, while current validate() contains no extension checks and the class has no unserialization hook to re-establish the constructor invariant.

Files Needing Attention: src/CloudEvents/CloudEvent.php

Important Files Changed

Filename	Overview
src/CloudEvents/CloudEvent.php	Moves extension validation into the constructor, but the previously reported native-unserialization gap remains.
tests/CloudEvents/CloudEventTest.php	Reworks extension validation tests to assert constructor-time rejection.
README.md	Documents constructor-time extension validation and the reduced responsibility of validate().

_{Reviews (4): Last reviewed commit: "feat: validate extension attributes in t..." | Re-trigger Greptile}