Modernize and complete the Fleetbase PHP SDK

[roncodes]

Summary

Completes the implementation portion of the v1.1.0 Fleetbase PHP SDK modernization plan while preserving the published 1.0.2 and 1.0.3 API surface.

• maps all 220 locked Fleetbase and Core API Postman requests to 35 explicit service groups
• validates official path, query, JSON, multipart, authentication, and response-fixture contracts
• adds 220 generated PHP examples that execute through the public facade in the hermetic test suite
• modernizes configuration, PSR-18 transport injection, errors, retries, list hydration, resources, and repaired legacy order actions without inventing unsupported SDK pagination
• supports PHP 7.4 through 8.5 with lowest/latest dependency resolution
• verifies plain PHP, Laravel, and Symfony consumers from the inspected distribution archive
• replaces tracked dependencies and credential-dependent tests with reproducible tooling and hermetic behavior tests
• updates README, badges, migration guidance, changelog, release notes, community files, and maintainer runbooks
• prepares the 1.1.0 license change to AGPL-3.0-or-later; existing 1.0.x tags retain their original MIT terms

Compatibility and contract evidence

• reflection/runtime compatibility checks pass against both 1.0.2 and 1.0.3
• 220 of 220 official requests are mapped, executed, and represented in the API matrix
• 34 PHPUnit tests execute 2,300 assertions without live credentials
• generated services, tests, examples, and coverage documentation are drift-checked
• clean archive-backed plain PHP, Laravel, and Symfony installs pass, including optimized --no-dev autoloading

CI and security evidence

Final CI run: https://github.com/fleetbase/fleetbase-php/actions/runs/33594931921

• PHP 7.4–8.5, lowest/latest: pass
• quality, PHPStan max, compatibility, and contract gates: pass
• fresh Xdebug coverage: 100.00% classes, methods, branches, and lines
• mutation baseline: 1,545 mutants, 1,329 killed, 212 escaped, 4 timed out, 0 uncovered; MSI 86.02%
• inspected distribution and archive-backed consumers: pass
• complete 1.1.0 release-candidate archive, SBOM, checksums, coverage, and API evidence: pass

Final security run: https://github.com/fleetbase/fleetbase-php/actions/runs/33594931697

• Composer audit and AGPL metadata: pass
• dependency review: pass
• verified-secret history scan and verified/unknown current-source scan: pass
• CodeQL workflow analysis with locally enforced SARIF findings: pass

Release and contract automation

• pinned-action CI, security, release, contract-drift, and disposable full-stack contract workflows are included
• releases require a reviewed commit on main, a protected release environment, explicit publish input, archive/SBOM/checksum evidence, provenance, and post-publication Packagist installation verification
• the disposable contract workflow builds the exact locked Fleetbase stack, proves Core API/Fleet-Ops revisions, runs both official Postman collections, and runs SDK success/failure smoke cases against the same instance
• the scheduled drift workflow compares current official Postman contracts and opens or updates a repository issue on material drift

The ordinary pull-request suite is intentionally hermetic: it uses PSR-18/Guzzle test doubles and does not call a live API. The separate disposable contract workflow is the full-stack integration layer.

New standalone workflows cannot be manually dispatched until their files exist on the default branch. The equivalent release candidate is already exercised by pull-request CI. The native Postman workflow additionally requires a POSTMAN_API_KEY repository or organization secret.

Maintainer approvals after review

No repository settings, tag, release, Packagist publication, external API-reference repository, or default branch were changed by this PR. Maintainers must still:

1. confirm relicensing rights for AGPL-3.0-or-later;
2. approve the permanent mutation-score threshold (the measured baseline is 86.02%; no source is excluded);
3. configure protected release approvers and signing/attestation policy;
4. verify Packagist ownership and webhook delivery;
5. authorize the coordinated API-reference generator change;
6. add POSTMAN_API_KEY and run the disposable native contract workflow after the workflow is present on the default branch;
7. follow the checked-in master to main migration runbook and verify every integration.