fix: fetch() validation hardening — named args, string-keyed arrays (closes #205, refs #206)

[s2x]

Description

Closes #205, refs #206 (DX part)

Hardens ZVecCollection::fetch() argument validation: the reported Undefined array key 0 warning is gone and named-argument calls get clear ZVecException messages instead of confusing errors, silent misbehavior or native segfaults found during code review.

Changes

• Guard is_array($args[0]) with isset() so fetch(pks: ['doc1']) no longer emits a PHP warning before the validation error (bug: fetch(pks: [...]) emits "Undefined array key 0" warning before rejecting #205)
• Named-arg pks: rejected with a calling-convention hint in all forms, including next to a positional array (previously silently ignored)
• fetch('doc1', ['name']) (scalar PK + outputFields array) now throws a hint to use fetch(['doc1'], ['name']) (enhancement: fetch() mixing scalar PK and outputFields array fails with confusing "PKs must be non-empty strings" #206 DX part)
• toCStringArray(): reindexes with array_values() and rejects non-string elements — string-keyed arrays previously corrupted memory and segfaulted (protects all FFI string-array call sites)
• Unknown named arguments (fetch('pk1', foo: 'bar')) throw with a hint instead of segfaulting
• outputFields: accepted as a named argument in both forms (previously silently ignored)
• Note added to CHANGELOG: fetch() result order is not guaranteed by the engine (verified for positional arrays too)

Testing

• Builds locally (FFI library present)
• New tests/test_fetch_validation.phpt passes (rejections + no-warning assertions + string-keyed/named-arg forms)
• Full suite: php run-tests.php -n tests/ → 178 passed, 1 known environmental failure (test_collections_thread_safety.phpt — macOS FD limit 256, pre-existing on main, passes on Linux CI)
• No test database leftovers (test_dbs/ empty)
• BC verified: all previously-valid call forms keep working (variadic scalars, list arrays, array+outputFields, includeVector: variants)

Code Review

• Passed subagent code review (2 rounds)
• Round 1 findings fixed: string-keyed array segfault (HIGH), named-arg bypass (MEDIUM), unknown named-arg segfault (HIGH), test gaps, README overclaim
• Round 2 re-review: all findings confirmed fixed, no crash or silent-wrong-result path remaining; one LOW exotic spread-call shape (fetch([1 => ['name']]) returns empty result) left as follow-up candidate

Follow-up candidates (not part of this PR)

• LOW: fetch([1 => ['name']]) (single array argument at non-zero spread key) returns an empty result instead of erroring — exotic input, no crash
• enhancement: fetch() mixing scalar PK and outputFields array fails with confusing "PKs must be non-empty strings" #206 enhancement part: accepting fetch('doc1', ['name']) outright (this PR only improves the error message)