Release 2.6.0: PHPStan and mutation testing in CI, bounded contextual serializers, linear collection validation

[yuriizee]

Tooling

• PHPStan level 5 in CI (phpstan.neon.dist); the Laravel traits are analysed through the classes that use them (S4-F10).
• Infection in CI, minCoveredMsi 84; covered MSI 83% → 86% with tests that pin the ciphertext formats, the blind index, __set_state defaults, file-cache, XML and unknown-key edge cases (S4-F13).

Fixed

• toArray($context): contexts not declared in #[Hidden(except:)] share one serializer, at most 64 cached per class. 20 000 contexts: +132 MB / 308 ms → +0 MB / 13 ms (S2-02).
• fromValidated() on large #[InferRules] collections: wildcard rules are expanded per item when the result is identical — 8 000 items 1.3 s → 0.2 s. Rules with * in parameters and distinct keep the wildcard; an equivalence test compares errors with Laravel's wildcard validation (S3-F6).
• Money::toDecimal() exact beyond 2^53, 156 → 114 ns (S3-F8).

Added (opt-in)

• CommaSeparatedCast(maxItems:) — 9.5 MB of commas: 537 MB → 9.5 MB peak (S3-F15).
• SensitiveVarDumperCaster::register() redacts #[Sensitive] fields in dump() / dd() (S1-08).

Docs

• Cache deploy order (warm → reload PHP, opcache.validate_timestamps=0) and cache-directory permissions (S2-01, S4-F11).

Verification

• Docker: 872 tests, 100% line coverage (2146/2146); PHPStan clean; Infection exit 0.
• Benchmarks: hydration/serialization ±3% (noise); toArray($context) +3–6 ns, toArray() unchanged.