ci: generate the linux engine definitions natively instead of through docker

[lisachenko]

What this changes

Unblocks the linux header-drift job that is red on every pull request against master (last seen on #289).

The job regenerated include/8.6/linux-x64-* inside the official docker image. For PHP 8.6 that produces a diff nobody can commit: docker-library ships the pre-release php:8.6-rc-cli image as a ZTS build (there is no nts variant), so the nts target silently came out as a ZTS artifact (TSRM symbols, ZTS layouts) under the nts name.

• header-drift becomes an nts/zts matrix that runs generate.php --native on the runner's setup-php build (the same build the tests jobs run on) and diffs the leg's own directory. The canonical nts leg also diffs stubs/ and .phpstorm.meta.php. This is the same model the darwin and windows drift jobs already use.
• New dispatchable "Generate linux headers" workflow (.github/workflows/generate-linux-headers.yml), mirroring the darwin/windows ones: regenerates both legs natively, uploads the artifacts (plus the stubs from the nts leg) and commits them to the branch in one commit. It also triggers on pull requests touching the generator, so it ran on this PR and refreshed the 8.6 linux artifacts here (ZEND_MODULE_API_NO 20260924 and the four vm_stack_page_cache* executor-globals fields); the darwin workflow refreshed the darwin artifacts the same way (identical to the ones on merge: cascade 8.5 into master (PHP 8.6 class-type fix) #289).
• composer gen-headers (the local docker path) now builds into a staging directory and refuses an image whose thread-safety mode does not match the target, instead of writing a ZTS layout into the nts directory.
• Ports the three-file PHPStan 2.3 test cleanup from the 8.5 branch (3843b85, b807faa): master's own tree no longer passes composer phpstan with today's unlocked PHPStan, and the cascade (merge: cascade 8.5 into master (PHP 8.6 class-type fix) #289) brings the same change, so this no-ops once it merges.
• AGENTS.md / CONTRIBUTING.md updated accordingly.

Note: the job name changes from Generated headers up to date to Generated linux headers up to date (nts) / (zts). If a branch-protection rule names the old check, it needs updating.

After this merges, merging master into the #289 cascade branch makes #289 fully green.

Environment it was verified on

• PHP version (full first line of php -v): CI, PHP 8.6.0-dev via setup-php (no PHP 8.6 locally); YAML validated, php -l and php-cs-fixer clean on tools/generator/generate.php
• Thread safety: NTS / ZTS (both legs in CI)
• OS / architecture: ubuntu-latest x64 (plus the macOS and Windows legs)
• Debug build (--enable-debug)? no (the debug-build CI legs are green too)

Checklist

• Targets the minimum affected version branch (master = newest supported minor) — the 8.4 and 8.5 branches still get nts and zts docker images and are unaffected
• composer test passes on the matching PHP minor — every CI test leg is green on the current head
• composer phpstan (level max) and composer cs:check are green
• Tests added or updated; structs the code dereferences are listed in layout_structs — n/a, no engine access changed
• If tools/generator/symbols.php changed: regenerated — symbols.php unchanged; the artifacts were regenerated and committed by the workflows, nothing hand-edited
• Conventional Commits used for the commit messages

🤖 Generated with Claude Code

https://claude.ai/code/session_01VLQcsvgdQUzwBFsoKUAcG2