feat: Symfony bundle packaging (Plan 3)

[erikfrerejean]

Summary

Completes Plan 3 — makes wedevelopnl/audit-log a working Symfony bundle. Builds on the merged core (Plan 1) and Doctrine adapter (Plan 2):

• AuditRenderer contract (framework-free core) + TranslatorAuditRenderer with a configurable translation domain.
• Symfony runtime adapters (Infrastructure/Symfony): SecurityActorResolver, RequestOriginResolver, UuidIdentityGenerator, NullSubjectLabeller. Resolvers read ambient state at call time (worker-mode safe), proven by behavioural tests.
• Composition root: DependencyInjection/{AuditLogExtension,Configuration} + services.php + AuditLogBundle. Pre-wires every port and prepends the Doctrine DBAL types + entity mapping (zero consumer config).
• End-to-end functional test booting a real kernel — proves the whole container wires record→read through the prepended types/mapping.
• Igor worker-mode gate added to CI.
• ADR 0009 records the bundle-packaging decision (supersedes ADR 0006, whose status is flipped); installation guide added.

Notable decisions / deviations from the plan

• symfony/framework-bundle kept in require (your call) — it's pulled transitively by doctrine-bundle and not imported by src/, but kept to declare the full-stack Symfony 8 target.
• composer igor runs igor-php --no-agent . — the plan assumed Igor would analyse the TestKernel via its console agent, but a console-less bundle has no bin/console. --no-agent does a deterministic static scan of src/. The plan's "igor": "igor" script was also corrected to the real binary name. Verified the gate has teeth (flags a stateful service, exit ≠ 0).
• Functional test harness: booted with debug=false + a tearDown() that pops FrameworkBundle's leaked global ErrorHandler, required by the project's strict failOnRisky=true. symfony/phpunit-bridge was deliberately not added — it would install its own deprecation handler and conflict with failOnDeprecation.
• Privacy: replaced the internal client domain pouw.nl with example.com across new and pre-existing test fixtures.
• Minor PHPStan/Symfony-8 corrections (covariant return narrowing, removed non-chainable ->end(), dropped invalid auto_generate_proxy_classes).

Verification (all green locally)

Gate	Result
php-cs-fixer	clean
PHPStan (max + type-coverage)	no errors
Rector	clean
Deptrac	0 errors
Igor (worker-mode)	worker-safe
PHPUnit	40 tests, 122 assertions
Infection	99% MSI (≥95 required)

Each code task went through fresh-subagent implementation + two-stage review (spec compliance, then code quality).