[vitormattos]

Goal

Support the release workflow modernization in LibreCodeCoop/.github#85 without embedding independent Python metadata parsers or GitHub permission policies in workflow YAML.

Changes

• Implement build:inspect as a PHP CLI use case with isolated filesystem reader, Nextcloud appinfo version/minimum compatibility validation, and safe package.json Node/npm engine extraction.
• Return no Node/npm engine values if the consumer lacks package.json; preserve fallback Node ^24 / npm ^11.3 only when a package manifest exists.
• Reject malformed XML/JSON, invalid engine types and control-character injection into GitHub Action outputs.
• Expose small, versioned composite adapters actions/build-inspect and actions/authorization-check, the latter reusing the existing tested release:authorization permission policy.
• Add PHPUnit behavior and CLI-output regression tests, public Action acceptance contracts, and a minimal integration note.
• Bump version to 0.11.21. Publishing this tagged release and PHAR is a prerequisite before repinning the consuming workflow in refactor(release): testable publishing and latest-stable nightly workflows .github#85.

Validation completed locally

• PHPUnit full suite: 278 tests, 950 assertions on PHP 8.5.
• PHPUnit targeted tests: 46 tests, 198 assertions on PHP 8.3.
• PHPStan, PHP_CodeSniffer, PHP-CS-Fixer (dry-run), PHPMD, Rector (dry-run), Deptrac passed.
• Box PHAR configuration validation and compilation passed. Local PHAR build is not substituted for the published 0.11.21 release.
• Full suite on the isolated PHP 8.3 Docker image is blocked by the image's missing Python interpreter, required by legacy compatibility tests; GitHub CI on official runner must pass prior to merge.

Release and downstream sequence

1. Review and merge this PR with a merge commit (no squash) once required GitHub checks pass.
2. Confirm v0.11.21 release exists with PHAR/checksum, and validate CLI build:inspect is present in published PHAR.
3. Update refactor(release): testable publishing and latest-stable nightly workflows .github#85 to consume the exact new commit SHA in the composite Actions, preserve Dependabot action pins, validate and merge.

No live consumer build, App Store publication or nightly tag mutation is triggered by this PR.