fix(security+psalm): update phpunit to 12.5.9 and suppress ForbiddenCode

Security:
- phpunit/phpunit updated from ^12.0 to ^12.5.8 (resolves CVE-2026-24765:
  unsafe deserialisation in PHPT code coverage handling, severity HIGH)
- 'composer audit' now reports no vulnerabilities

Psalm ForbiddenCode:
- Add @psalm-suppress ForbiddenCode on shell_exec() calls in:
  - src/Core/ProcessExecutor: tier-3 binary resolution via 'command -v'
  - src/Runner/ComposerAuditRunner: composer binary resolution
  Both uses are safe: input is sanitised with escapeshellarg()

Local CI simulation results:
  dependencies  PASSED (composer validate + check-platform-reqs)
  security      PASSED (no advisories)
  phpstan       PASSED (PHPStan level 9: 0 errors; Psalm: 0 errors)
  cs-fixer      PASSED (code style OK)
  tests         OK (41 tests, 81 assertions)

Author: walmir-silva

composer.json

@@ -27,9 +27,9 @@
         "php": ">=8.4"
     },
     "require-dev": {
-        "phpunit/phpunit": "^12.0",
-        "phpstan/phpstan": "^2.0",
         "friendsofphp/php-cs-fixer": "^3.64",
+        "phpstan/phpstan": "^2.0",
+        "phpunit/phpunit": "^12.5.8",
         "rector/rector": "^2.0",
         "vimeo/psalm": "^6.0"
     },

src/Core/ProcessExecutor.php

@@ -99,6 +99,7 @@ public function resolveBinary(string $vendorBin): ?string
 
         // Tier 3: Global PATH
         $basename = basename($vendorBin);
+        /** @psalm-suppress ForbiddenCode — shell_exec is intentional for binary resolution; input is escaped */
         $globalBin = trim((string) shell_exec('command -v ' . escapeshellarg($basename) . ' 2>/dev/null'));
         if ('' !== $globalBin && is_executable($globalBin)) {
             return $globalBin;

src/Runner/ComposerAuditRunner.php

@@ -39,6 +39,7 @@ protected function defaultArguments(): array
     #[\Override]
     protected function binary(): ?string
     {
+        /** @psalm-suppress ForbiddenCode — shell_exec is intentional for binary resolution; input is escaped */
         $global = trim((string) shell_exec('command -v ' . escapeshellarg('composer') . ' 2>/dev/null'));
 
         if ('' !== $global && is_executable($global)) {