Prepare Identity SDK PHP 2.5.1 release

[danifronter]

Scope

Prepare the reviewed source and immutable release procedure for SDK PHP v2.5.1. The patch restores P-256 DPoP key generation on OpenSSL 3.6, keeps PHPStan bounded on smaller machines, fixes the canonical Composer branch alias and removes duplicate internal PHPDoc.

There are no public API, claim, algorithm, endpoint or wire-format changes.

Release governance

• date and scope are frozen in the changelog
• PHP 8.2–8.5 compatibility matches the enforced CI matrix
• RELEASE-2.5.1-CHECKLIST.md defines the exact reviewed-SHA/tag/release process
• tags are immutable; a post-release defect requires a new patch
• consumer lockfiles remain unchanged until their own runtime gates pass

Local evidence

• clean stable dependency resolution using published identity-contracts v2.0.0
• composer verify passed
• PHPUnit: 44 passed, 199 assertions
• PHPStan: no errors
• Composer audit: no advisories
• git diff --check: passed

External gate

Do not create v2.5.1 or the GitHub release until this PR is approved and the PHP 8.2/8.3/8.4/8.5 matrix is green.