Reference cross-class and global attribute first-class callables by declaration site on PHP 8.5

[nicolas-grekas]

Stacked on #26.

First-class callables over a method of their own declaring class already serialize as a const-expr declaration-site reference. Cross-class references (#[When(Validators::check(...))]) and global functions (#[When(strlen(...))]) could not: the closure carries no link back to the class whose attribute declares it — its scope is the target, or none at all. PHP 8.6 records that declaring class as engine provenance (ReflectionFunction::getConstExprClass); 8.5 does not, so these fell to the by-name path and required allow_named_closures.

This recovers the declaring class on 8.5 by instrumenting the two paths frameworks use to read attribute metadata — ReflectionAttribute::getArguments() (the closures are the returned argument values) and ::newInstance() (they are properties of the returned attribute instance). For each cross-class or global first-class callable produced, the declaring class, read from the ReflectionAttribute, is recorded in a per-worker index. At to_array time, when the scope-based locate misses, the index yields the declaring class and the closure resolves to the same declaration-site reference (mask 1). Decode is unchanged, and no allow_named_closures opt-in is needed: these remain references resolvable only to what the named class itself declares, and allowed_classes still gates Closure.

• Persistent, name-keyed index. Keyed and valued by names, not pointers (op_arrays and class entries churn per request without opcache), and kept across requests, so once a declaration has been seen it resolves in later requests too — effective for a worker's lifetime under opcache.preload. The declaring class is re-resolved (without autoloading) and re-located each time, so a stale entry simply misses instead of mis-resolving.
• Identity-based locate. The walk matches a target by identity: user functions by op_array.opcodes (methods, user globals, anonymous closures), internal functions by name and scope. The capture walk is cycle-guarded, since newInstance() returns an object built by an arbitrary attribute constructor.
• No INI knob. The hooks are installed at MINIT on a build without native provenance and skipped when ReflectionFunction::getConstExprClass exists, since the engine-id path resolves these directly there. So this self-removes exactly where 8.6-native takes over.

Caveats, in the open:

• Recovering the declaring class needs reflection's private object layout, mirrored here and tracking the engine structs.
• Encoding is load/reflection-order dependent: a runtime callable equivalent to a declared one serializes as a site reference once that declaration has been seen this worker, otherwise by name. Always safe (bounded to what classes declare) and decode is deterministic.
• The lookup does not autoload, so the declaring class must be loaded when serializing (resident under preload).
• No polyfill counterpart: userland cannot hook reflection. The polyfill decodes these payloads (they are standard declaration-site references), except internal-global-function ones, whose line 0 reference trips its ReflectionFunction::getStartLine()-based staleness check and fails closed (a cache miss, not corruption).

New tests/deepclone_attribute_provenance.phpt covers cross-class via getArguments, own-class unaffected, cross-class via newInstance, internal and user global functions, and the by-name fallback for a callable no attribute declares. It is SKIPIF'd on PHP < 8.5 and on builds that already expose native provenance.

There is no polyfill companion: this capability is extension-only.