refactor(symfony): align components with DI-friendly wrappers

[somethingwithproof]

Summary

• Adds DI-friendly Cacti wrappers around Symfony Process, Console, Validator, Mime, Filesystem, Form, and Clock, with injectable instance APIs plus static facades for legacy call sites.
• Expands CactiProcess across production shell execution paths so commands use argv arrays where practical and centralize legacy command-line execution behind one wrapper.
• Centralizes long-lived process pipes in CactiProcessPipe, leaving production proc_open() usage in one reviewed abstraction.
• Applies a focused CactiFilesystem pass in package, plugin, spikekill, and poller cache file operations.
• Adds FormatterHelper access through the console bootstrap and CactiCommand.

Architecture Direction

This is the Symfony component baseline for develop. We are not introducing the full Symfony container yet. New code should depend on Cacti-owned injectable wrappers, while older procedural code can use the static facades during migration.

Process execution should prefer argv arrays through CactiProcess; runCommandLine() is reserved for internally built legacy command strings that still need compatibility. Filesystem-sensitive writes, deletes, copies, mkdirs, temp names, and path checks should use CactiFilesystem when touched.

Consolidation

This PR supersedes the direction of the smaller Symfony component PRs #7073, #7075, and #7077. Those PRs can remain useful as review history, but the merge direction should be this consolidated DI-friendly implementation.

Symfony Mailer replacement remains separate in #7190 so mail transport behavior can be reviewed independently.

Validation

• php -l over touched PHP files
• git diff --check
• Source scan confirms no production exec, shell_exec, system, or passthru call sites remain
• Raw production proc_open() is centralized in lib/CactiProcessPipe.php
• Pest was not run locally because include/vendor/bin/pest is missing in this worktree

[somethingwithproof]

Added a follow-up process hardening commit (2eb5ec4) on this branch.

Summary:

• Replaced production exec() / shell_exec() call sites with CactiProcess argv-mode calls where the process runs to completion.
• Kept long-lived bidirectional proc_open() sessions for the script server and rrdtool pipe, but changed those command arguments to argv arrays so PHP does not route through a shell string.
• Moved mysql password handling for mysqladmin/mysql schema load to MYSQL_PWD via env_set instead of argv strings.
• Added a source guard test covering the migrated production files.

Local validation:

• php -l over all touched PHP files
• git diff --check
• Source scan: no production exec(), shell_exec(), system(), or passthru() calls remain outside tests/comments after the update.

[somethingwithproof]

Added follow-up commit 46a0579.

Summary:

• Introduces CactiProcessPipe as the only production wrapper around proc_open for long-lived bidirectional subprocesses.
• Moves cmd.php, remote_agent.php, and cli/rrdresize.php pipe launches through CactiProcessPipe.
• Extends guard coverage so raw production proc_open is only allowed in CactiProcessPipe.
• Applies a focused CactiFilesystem pass across plugin archive restore/archive, package temp XML cleanup, spikekill XML/backup handling, and poller cache write paths.
• Moves the poller cache PHP syntax check from system() to CactiProcess.

Validation:

• php -l over touched files
• git diff --check
• Source scans remain clean for production exec/shell_exec/system/passthru. Raw proc_open is now centralized in lib/CactiProcessPipe.php.