feat(php): add a PHP skill, grounded in the synchra-php SDK and the bleichi site

PHP was the one language with real code in two shapes here and no skill: a
Composer library held at PHPStan level max, and a plain PHP-FPM application
behind nginx with no framework. The rules come from reading both rather than
from general PHP advice, so each one names the failure it prevents.

The two halves differ enough to be separate sections. A library requires PSR
interfaces and ships no implementation; an application's rules are about
escaping, keeping the document root unwritable, atomic writes and sessions.
Everything in §1-§8 applies to both.

Three findings are worth the space they take because they were each paid for
once already: `json_encode` with JSON_UNESCAPED_SLASHES into an inline
<script> is an XSS hole, a web user that cannot write its own cache fails
silently on every request, and inside the dev container the host's own `php`
bridge shadows the real interpreter so every vendor/bin tool dies naming
distrobox.

docs(python): cover MCP servers, Red cogs and HA components, and correct three
rules the owner's own code contradicts

The skill described a toolchain and was silent on the four things most of this
Python actually is. Three of its rules are also wrong in context, and the code
is right: getLogger(__name__) puts a cog outside the red.* tree where Red's log
controls apply; TaskGroup's cancel-on-first-error is the wrong default for
fan-out over N providers, where the real pattern is a semaphore plus
gather(return_exceptions=True); and the gate runs locally and through
pre-commit, not through CI, which never runs under this account.

Also: ruff ALL-minus-documented-ignores is the preferred shape rather than the
explicit select list, lockfiles split by artifact type, and bare `python` and
bare `pip` are different interpreters on this host.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

coding-dev.md

@@ -5,7 +5,7 @@ description: >-
   in any language. Defines standing preferences on strictness, dependency choice, file and function
   size limits, test discipline, build output handling, error/warning policy, and commit hygiene.
   Links to per-language rules under code-languages/ for Rust, TypeScript/JavaScript, Bash, Python,
-  Go, C#/.NET, and C/C++.
+  PHP, Go, C#/.NET, and C/C++.
 ---
 
 # Coding & Development — Standing Rules and Preferences
@@ -34,6 +34,7 @@ Per-language specifics live in [`code-languages/`](skills-public/code-languages/
 | TypeScript / JavaScript | [`code-languages/js-typescript.md`](skills-public/code-languages/js-typescript.md) |
 | Bash / Shell | [`code-languages/bash.md`](skills-public/code-languages/bash.md) |
 | Python | [`code-languages/python.md`](skills-public/code-languages/python.md) |
+| PHP | [`code-languages/php.md`](skills-public/code-languages/php.md) |
 | Go | [`code-languages/go.md`](skills-public/code-languages/go.md) |
 | C# / .NET | [`code-languages/csharp-dotnet.md`](skills-public/code-languages/csharp-dotnet.md) |
 | C / C++ | [`code-languages/c-cpp.md`](skills-public/code-languages/c-cpp.md) |