chore(deps-dev): update phpunit/phpunit requirement from ^11.0 to ^13.3

Adopts infinito-nexus/core#568. The composer.json hunk is byte-identical to that PR; vendor/ and composer.lock are gitignored, so it is the only file the PR touches.

The docstring in utils/install/php.py names the constraint verbatim and would have gone stale, which dependabot cannot see.

Verified rather than assumed: phpunit 13.3.2 requires php >=8.4.1 where 11.x asked for >=8.2, and the project container runs 8.4.24. A partial update fails because the lock pins the transitive packages, so resolving needs -W, which carries fourteen packages along including php-code-coverage 11.0.12 to 14.3.2. The suite then runs green under the new major: 26 tests, 56 assertions, no deprecation and no warning, with phpunit.xml setting failOnWarning and failOnRisky.

Open: ensure_php_toolchain takes whatever php the distro ships and states no minimum, so a matrix row on php below 8.4.1 breaks at composer install rather than at a named check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

composer.json

@@ -4,7 +4,7 @@
   "type": "project",
   "license": "MIT",
   "require-dev": {
-    "phpunit/phpunit": "^11.0"
+    "phpunit/phpunit": "^13.3"
   },
   "config": {
     "sort-packages": true

utils/install/php.py

@@ -19,7 +19,7 @@ _PHPUNIT_EXTENSIONS = ("dom", "mbstring", "xmlwriter")
 def ensure_php_toolchain() -> None:
     """Install the PHP interpreter, Composer and the extensions PHPUnit needs.
 
-    ``phpunit/phpunit ^11`` declares ``_PHPUNIT_EXTENSIONS`` as platform
+    ``phpunit/phpunit ^13`` declares ``_PHPUNIT_EXTENSIONS`` as platform
     requirements and Composer refuses to resolve the vendor tree without them,
     so they are part of the toolchain rather than of the suite consuming it.
     A distro ships them as packages separate from the interpreter, which is why