test: enforce exhaustive scenario contracts

[jordyloeuille]

Summary

• turn scenario coverage into an enforceable contract instead of relying on a raw scenario count
• require every public non-diagnostic TG rule to have at least one positive and one negative scenario
• add the previously missing negative controls for TG008, TG014, TG017, TG022, TG023 and TG100
• exhaustively validate the finite Cache, RateLimiter, Redis, query-builder, Eloquent static/instance and relation mutation catalogs
• validate Redis mutation/read/script/control classification consistency and catalog parity
• add dedicated integrity coverage for TG900, TG901, TG902 and TG903, with permission-based TG903 coverage skipped when the executing process can bypass chmod restrictions

Analysis

The existing suite is already broad, with more than 234 syntactically valid transaction scenarios. Literal coverage of every possible PHP program is impossible because the input space is unbounded. The correct production-grade closure is to exhaust the finite contracts the package publishes and to make future changes fail if they add a rule or catalog entry without tests.

The first exhaustive run proved all finite operation catalogs were already correctly detected by the scanner. It exposed one test-coverage gap instead: TG008 had positive mutation scenarios but no explicit negative read-only cache control. That control is now part of the dependency-free scenario matrix.

This PR combines broad scenario testing with completeness meta-tests and data-driven catalog coverage. It runs on the merge-blocking Linux, Windows and macOS matrix introduced in #105.

Scope

Tests, test-support, scenario documentation and changelog only. No analyzer production logic was changed because the exhaustive catalog tests did not expose a scanner implementation gap.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d6cb8e9459

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".