chore(quality): point PHPMD at the central ruleset

[rubenvdlinde]

What

Step 2a of the Nextcloud CI/CD alignment, following the merged reference
larpingapp#314.

file	before	after
phpmd.xml	local ruleset, 43 rules copied by hand	9-line stub → vendor/conduction/hydra-gates/quality-config/phpmd.xml
phpmd-unusedparams.xml	local copy	deleted; the second leg of composer phpmd points at the central copy

The phpmd script keeps both legs and the worst-exit-code behaviour:

E=0; ./vendor/bin/phpmd lib text phpmd.xml || E=$?; \
     ./vendor/bin/phpmd lib text vendor/conduction/hydra-gates/quality-config/phpmd-unusedparams.xml || E=$?; \
     exit $E

Verification

phpmd on this app was already clean, so exit 0 proves nothing — a stub that
silently scanned nothing produces exactly the same output. Two independent
checks were run instead.

1. The effective rule set, before and after

Dumped rule by rule through PHPMD's own RuleSetFactory (class, rule name,
priority, since, and every resolved property), plus each ruleset's effective
<exclude-pattern> set, resolved from the app root exactly as PHPMD resolves it:

before   43 rules   ignore-patterns: ['*/lib/Migration/*']
after    43 rules   ignore-patterns: ['*/lib/Migration/*']
IDENTICAL — every rule and every property matches

composer phpmd output is byte-identical before and after (0 findings, exit 0).

2. Positive control — the second leg is alive

A scratch copy of lib/ was given three probe classes and the post-change
script re-run:

probe	expectation	result
lib/ProbeControl/ProbeMainLeg.php — an else branch	leg 1 must report it	reported
lib/ProbeControl/ProbeUnusedParam.php — an unused parameter	leg 2 must report it	reported
lib/Migration/ProbeMigrationUnusedParam.php — same violation	leg 2 must not report it (the central exclude-pattern)	not reported

Exit code 2, i.e. the run can still fail. The probes exist only in the scratch
copy; nothing in this diff.

Deliberately not in this PR

• PHPStan and stylelint — separate steps (2b, 2d) of the same plan.
• Existing gate findings. Gates now scan the whole tree (ADR-020 superseded,
  .github@main 4c37371d), so development already carries this app's whole
  backlog. This PR adds nothing to it; phpmd itself stays green.
• Quality Report is an aggregator and never an independent defect.

[github-actions]

Quality Report — ConductionNL/decidesk @ cce6966

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 104/104
npm			✅	✅ 548/548
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-12 21:12 UTC

Download the full PDF report from the workflow artifacts.