feat(core): audit-remediation suite re-ported to the active EIR backend

Remediates the compiler-audit findings on the active EIR backend (the
legacy AST emitters under src/codegen/ are frozen and left as-is). Each
fix is verified byte-exact against the PHP CLI; builds warning-free,
whitespace- and assembly-alignment-clean; docs and the builtin registry
regenerated.

Builtins (element-type / argument coverage):
- round($mode): PHP_ROUND_HALF_UP / PHP_ROUND_HALF_EVEN.
- min()/max(): coerce a boxed Mixed operand to its numeric value.
- in_array()/array_search(): accept the optional $strict flag.
- array_sum()/array_product(): float-element arrays (float result reg).
- sort()/rsort(): float-element arrays ordered by IEEE numeric value.
- array_merge(): indexed string arrays via the 16-byte-slot helper.
- array_slice(preserve_keys: true): key-preserving associative slice.
- array_map($cb, $a, $b): two-input-array form (int/string subset).
- array_merge()/array_diff()/array_intersect(): accept three or more
  arrays, folded left-associatively into the two-array runtime with the
  intermediate arrays released.
- substr(): negative length drops characters from the end (PHP parity).
- is_a()/is_subclass_of(): boxed Mixed receiver (runtime class-id match)
  and string class-name subject (with is_a allow_string semantics).
- number_format(): multi-byte separators preserved (ptr+len ABI), and
  rounds half away from zero (PHP_ROUND_HALF_UP) instead of snprintf's
  half-to-even.

Language safety:
- Division / modulo by zero raise an (uncatchable) fatal instead of
  producing INF / 0; float `/` keeps NaN divisors as NaN.
- Constant folder computes `x % -1` as 0, avoiding the i64::MIN % -1
  overflow panic.

EIR note: ir_lower derives its own builtin result types independent of
the checker, so the float-aggregate, array_slice-preserve, two-array
array_map, and variadic-merge result types are fixed there as well as in
the type checker.

Known residuals (pre-existing, tracked separately): number_format() /
round() do not apply PHP's _php_math_round pre-rounding, so FP-error
half cases (e.g. 1.005) differ; array-builtin results are not fully
reclaimed when consumed, so nested/variadic merges leak the result
header block (the intermediate payloads are explicitly released).

macOS-aarch64 green locally; Linux x86_64 / aarch64 via CI.

Author: Guikingone

docs/internals/builtins/array/array_all.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_all.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_all.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:1536](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L1536) (`lower_array_all`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:1707](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L1707) (`lower_array_all`)
 - **Function symbol**: `lower_array_all()`
 
 

docs/internals/builtins/array/array_any.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_any.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_any.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:1531](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L1531) (`lower_array_any`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:1702](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L1702) (`lower_array_any`)
 - **Function symbol**: `lower_array_any()`
 
 

docs/internals/builtins/array/array_chunk.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_chunk.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_chunk.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:81](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L81) (`lower_array_chunk`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:87](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L87) (`lower_array_chunk`)
 - **Function symbol**: `lower_array_chunk()`
 
 

docs/internals/builtins/array/array_combine.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_combine.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_combine.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:152](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L152) (`lower_array_combine`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:158](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L158) (`lower_array_combine`)
 - **Function symbol**: `lower_array_combine()`
 
 

docs/internals/builtins/array/array_diff.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_diff.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_diff.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:874](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L874) (`lower_array_diff`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:996](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L996) (`lower_array_diff`)
 - **Function symbol**: `lower_array_diff()`
 
 
@@ -31,7 +31,7 @@ The following runtime helpers are referenced:
 ## Signature summary
 
 ```php
-function array_diff(array $array, ...$arrays): array
+function array_diff(array $array, ...$arrays): mixed
 ```
 
 ## What the type checker enforces

docs/internals/builtins/array/array_diff_assoc.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_diff_assoc.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_diff_assoc.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:1347](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L1347) (`lower_array_diff_assoc`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:1518](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L1518) (`lower_array_diff_assoc`)
 - **Function symbol**: `lower_array_diff_assoc()`
 
 

docs/internals/builtins/array/array_diff_key.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_diff_key.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_diff_key.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:896](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L896) (`lower_array_diff_key`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:1018](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L1018) (`lower_array_diff_key`)
 - **Function symbol**: `lower_array_diff_key()`
 
 

docs/internals/builtins/array/array_fill.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_fill.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_fill.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:115](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L115) (`lower_array_fill`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:121](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L121) (`lower_array_fill`)
 - **Function symbol**: `lower_array_fill()`
 
 

docs/internals/builtins/array/array_fill_keys.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_fill_keys.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_fill_keys.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:138](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L138) (`lower_array_fill_keys`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:144](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L144) (`lower_array_fill_keys`)
 - **Function symbol**: `lower_array_fill_keys()`
 
 

docs/internals/builtins/array/array_filter.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/array/array_filter.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/array/array_filter.rs)
-- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:211](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L211) (`lower_array_filter`)
+- **Lowering**: [`src/codegen_ir/lower_inst/builtins/arrays.rs`:217](https://github.com/illegalstudio/elephc/blob/main/src/codegen_ir/lower_inst/builtins/arrays.rs#L217) (`lower_array_filter`)
 - **Function symbol**: `lower_array_filter()`