[s2x]

What changed

Bump rector/rector from 2.3.9 to 2.6.7 and phpstan/phpstan from 2.1.45 to 2.2.16
together, with composer.lock regenerated.

Rector 2.3.9 reads the private $container property of PHPStan\Parser\RichParser, and that
property no longer exists from PHPStan 2.2.6 on, so every Rector below 2.5.8 dies with
MissingPrivatePropertyException before analysing a single file. That is what made the
phpstan/phpstan 2.1.45 -> 2.2.16 Dependabot bump (#6) fail lint and ci-ok. Rector 2.6.7
requires phpstan/phpstan ^2.2.14, so the two bumps cannot land apart.

Dev dependencies stay pinned exactly, in the style the file already uses. The runtime packages
array in the lock is empty and unchanged; only packages-dev moves.

No source file changes. Rector 2.6.7 reports an empty autofix across src, examples and
tests even though 25 releases of rules apply to this config, so there is nothing to revert and
no CHANGELOG.md entry: a dev-tool bump is not user-visible here.

Closes #23

How it was tested

• composer update rector/rector phpstan/phpstan --with-all-dependencies resolves both pins;
  composer why phpstan/phpstan shows rector/rector 2.6.7 requires phpstan/phpstan (^2.2.14).
• bin/lint.sh green end to end: composer validate and audit, PHP-CS-Fixer, PHPStan level 9
  ([OK] No errors), Rector dry run ([OK] Rector is done!), shellcheck.
• vendor/bin/phpunit green: 24 tests, 46 assertions (14 unit + 10 integration). The integration
  suite ran against a real libpiper built with make build-libpiper on this host.
• Both tools were negative-controlled so a silent pass could not be mistaken for a clean run: a
  temporary probe file made Rector fire SimplifyIfReturnBoolRector, RemoveAlwaysElseRector
  and RemoveUnusedPrivateMethodRector, and a temporary return-type violation made PHPStan report
  return.type. Both probes were deleted; git status src/ is clean.
• Reproduced the original failure in a scratch copy on rector 2.3.9 + PHPStan 2.2.16 to confirm
  the two bumps really are coupled.
• Independent review (Opus, round 1): ACCEPT.

Checklist

• Tests added or updated, and all checks pass (no test changes: no source behaviour changed;
  the existing suite covers it and was run)
• CHANGELOG.md updated under [Unreleased] (deliberately not: no user-visible change)
• Documentation updated (not needed)
• Everything is written in English
• The PR title is a Conventional Commit (feat: ..., fix: ...)