fix(sys-ctl-hlth-runtime): harden LAM CLI, catch apk options, drop vars comment

Addresses three CodeRabbit findings on PR #1265.

1. LAM hardening invisible to the probe (thread 4413764929): the runtime
   check probes PHP with `php -r`, the CLI SAPI. web-app-lam mounted the
   hardening ini only into /etc/php/8.4/apache2/conf.d, which the Debian
   CLI does not scan, so the probe read unhardened CLI settings and the
   check failed for LAM. The php_hardening entry now also mounts the ini
   into /etc/php/8.4/cli/conf.d. No other role mounts it into a Debian
   per-SAPI directory; the rest use the shared scan dir of the official
   image or of Alpine. The TODO entry now names the remaining gap: the
   probe reads only the CLI copy.

2. Explanatory comment above HEALTH_RUNTIME_FLOORS (thread 4413764949):
   removed. The README already states the end-of-life rule and now also
   defines a floor as the lowest patched release of each line.

3. `apk --no-cache add` missed (thread 4415018662): PACKAGE_INSTALL_PATTERN
   required `add` right after `apk`, so `RUN apk --no-cache add php7`
   passed as an image without PHP. The apk branch now accepts options
   before `add`, like the apt branch. New tests cover the option form and
   guard that `apk` in a path or a comment is no package install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/python/utils/docker/test_image_runtime.py

@@ -66,6 +66,20 @@ class TestPhpRuntime(TestCase):
             )
         )
 
+    def test_apk_options_before_add_still_name_the_line(self):
+        self.assertEqual(
+            runtime.php_runtime(["RUN apk --no-cache add php7 php7-fpm"]),
+            _php(lines=["7"]),
+        )
+
+    def test_apk_in_a_path_or_comment_is_no_package_install(self):
+        for instruction in (
+            "RUN rm -rf /var/cache/apk/* && cp php7 /srv/add",
+            "RUN echo php7 # apk cache: add nothing",
+        ):
+            with self.subTest(instruction=instruction):
+                self.assertIsNone(runtime.php_runtime([instruction]))
+
     def test_a_pinned_alpine_package_names_its_line(self):
         found = runtime.php_runtime(["RUN apk add --no-cache php84=8.4.27-r0 nginx;"])
         self.assertEqual(found, _php(lines=["8.4"]))