harden: restore gate baseline, split dev/prod PHP profile, atomic module runtime build

Phase A — Gate Reliability:
- Fix typography token violations in app-breadcrumb.css
- Switch QG-006 from composer cs:check to direct php-cs-fixer
- Align all docs/skills with new gate command

Phase B — Production Profile:
- Multi-stage Dockerfile: dev (xdebug) / prod (no xdebug)
- Compose files target explicit build stages

Phase C — Module Runtime Hardening:
- Atomic staging+swap build in ModuleRuntimePageBuilder
- SHA-256 fingerprint from manifest content + page entries
- 11 new regression tests for build safety and fingerprint drift

Task: STARTERKIT-HARDENING-ONPREM-001

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.prod.yml

@@ -16,6 +16,7 @@ services:
     build:
       context: .
       dockerfile: docker/php/Dockerfile
+      target: prod
     env_file:
       - .env
     environment:
@@ -23,7 +24,6 @@ services:
       APP_DEBUG: "0"
     volumes:
       - ./:/var/www
-      - ./docker/php/php.prod.ini:/usr/local/etc/php/conf.d/zzz-minty-dev.ini:ro
     depends_on:
       - db
       - memcached
@@ -33,6 +33,7 @@ services:
     build:
       context: .
       dockerfile: docker/php/Dockerfile
+      target: prod
     env_file:
       - .env
     environment:
@@ -40,7 +41,6 @@ services:
       APP_DEBUG: "0"
     volumes:
       - ./:/var/www
-      - ./docker/php/php.prod.ini:/usr/local/etc/php/conf.d/zzz-minty-dev.ini:ro
     depends_on:
       - db
       - memcached