harden: restore gate baseline, split dev/prod PHP profile, atomic module runtime build

Phase A — Gate Reliability:
- Fix typography token violations in app-breadcrumb.css
- Switch QG-006 from composer cs:check to direct php-cs-fixer
- Align all docs/skills with new gate command

Phase B — Production Profile:
- Multi-stage Dockerfile: dev (xdebug) / prod (no xdebug)
- Compose files target explicit build stages

Phase C — Module Runtime Hardening:
- Atomic staging+swap build in ModuleRuntimePageBuilder
- SHA-256 fingerprint from manifest content + page entries
- 11 new regression tests for build safety and fingerprint drift

Task: STARTERKIT-HARDENING-ONPREM-001

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/css/components/app-breadcrumb.css

@@ -38,7 +38,7 @@
   .app-breadcrumb li + li::before {
     content: "/";
     color: var(--app-muted-color);
-    font-size: 0.75em;
+    font-size: 0.75em; /* em-relative sizing — intentional */
     margin-inline-end: 0.375rem;
     pointer-events: none;
   }
@@ -68,7 +68,7 @@
 
   .app-breadcrumb [aria-current="page"] {
     color: var(--app-color);
-    font-weight: 500;
+    font-weight: var(--font-medium);
     pointer-events: none;
   }
 }