harden: restore gate baseline, split dev/prod PHP profile, atomic module runtime build

Phase A — Gate Reliability:
- Fix typography token violations in app-breadcrumb.css
- Switch QG-006 from composer cs:check to direct php-cs-fixer
- Align all docs/skills with new gate command

Phase B — Production Profile:
- Multi-stage Dockerfile: dev (xdebug) / prod (no xdebug)
- Compose files target explicit build stages

Phase C — Module Runtime Hardening:
- Atomic staging+swap build in ModuleRuntimePageBuilder
- SHA-256 fingerprint from manifest content + page entries
- 11 new regression tests for build safety and fingerprint drift

Task: STARTERKIT-HARDENING-ONPREM-001

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker/php/Dockerfile

@@ -1,4 +1,4 @@
-FROM php:8.5-fpm
+FROM php:8.5-fpm AS base
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
@@ -11,14 +11,27 @@ RUN apt-get update \
         libjpeg-dev \
         libpng-dev \
         libwebp-dev \
-    && pecl install memcached xdebug \
-    && docker-php-ext-enable memcached xdebug \
+    && pecl install memcached \
+    && docker-php-ext-enable memcached \
     && docker-php-ext-configure gd --with-jpeg --with-webp \
     && docker-php-ext-install pdo_mysql mysqli gd zip \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+WORKDIR /var/www
+
+# ── Development profile (default) ────────────────────────────────────
+FROM base AS dev
+
+RUN pecl install xdebug \
+    && docker-php-ext-enable xdebug
+
 COPY docker/php/php.ini /usr/local/etc/php/conf.d/zzz-minty-dev.ini
 COPY docker/php/xdebug.ini /usr/local/etc/php/conf.d/zzz-xdebug.ini
 
-WORKDIR /var/www
+# ── Production profile ───────────────────────────────────────────────
+# No xdebug — smaller image, no debug overhead or attack surface.
+FROM base AS prod
+
+COPY docker/php/php.prod.ini /usr/local/etc/php/conf.d/zzz-minty-prod.ini