[rmcdaniel]

The standalone CLI currently embeds PHP 8.4.23. This updates Linux, macOS and Windows to PHP 8.4.27 and refuses to package the application unless the produced micro runtime reports the exact configured stable version and a consistent version ID.

The runtime probe and verifier come from the qualified release-control checkout and run on both cold builds and restored caches, including the nonpublishing cache-warm path. The existing PHP-version/workflow cache identity, pinned static-php-cli checksums, isolated publication handoff and provenance controls remain in place. Failed runtime verification also marks the toolchain timing result as failed and retains bounded runtime evidence with the build logs.

dw runtime:check also reports the actual running PHP version and SAPI before checking extensions, so the downloaded standalone can identify its embedded runtime directly.

Validation:

• Full PHP suite: 921 tests, 17,394 assertions, one skip and 11 PHPUnit deprecations.
• Release/installer contract suite: 15 tests, 384 assertions.
• Node release-contract suites: all 27 tests passed, including rejection of old runtimes, external PHP, mismatched versions and invalid probe output.
• Runtime diagnostic tests: four tests and 12 assertions passed, including identity output when extensions are missing.
• The new workflow regression test fails against the previous release workflow because it lacks the runtime guard.
• At final head 44d6ef906d3a3db524ab683f608008b00baa0923, all 16 reported checks pass, including normal GitHub PHP 8.2–8.5, PHAR smoke/reproducibility, central action policy, boundary, CodeQL and Sonar checks. Build run.
• All four native builds and public installed-binary acceptance remain to be verified through the normal protected workflows.

CodeQL alert #8 was reviewed and dismissed specifically as a false positive. Warming resolves source and control to the exact main SHA; dispatch is main-only; release source must match an existing protected repository tag; PRs cannot enter the cache-writing paths. The new step uses pinned/checksummed SPC and probe/verifier code from the exact control checkout, after exact-key/hash validation of any restored micro runtime. This does not claim main ancestry for release tags. No scanner, repository setting or release gate changed.

Refs #65. This PR does not complete the issue's publication and installed acceptance requirements; the existing 2.3.0 tag and assets remain untouched.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Released as 2.3.1. Full publication and installed acceptance verifies all four native targets, portable PHAR, public installers/checksums and exact-source signatures for all ten assets. Existing 2.3.0 tag/assets are unchanged.