chore(quality): adopt the central PHPStan base config

[rubenvdlinde]

What

phpstan.neon now includes the shared base that ships in conduction/hydra-gates
(quality-config/phpstan-base.neon). Everything the base already provides — level,
paths, bootstrapFiles, excludePaths, scanDirectories and the fleet-wide ignore list —
is removed from the app file. What stays is only what is genuinely local:

• the app's own phpstan-baseline.neon include
• three excludePaths entries for the AppHost-delegating controllers, whose
  "extends unknown class" error PHPStan refuses to let ignoreErrors silence
• the tests/Stubs/Mcp/IMcpToolProvider.php entry under scanFiles
• one ignore for the NC Talk room manager inferred as stdClass

Note: the app previously lacked the base's registerRepairStep ignore. Adding it
can only suppress, and the finding count is unchanged.

This is step 2b of the Nextcloud CI/CD alignment programme.

Why hydra-gates moves to v1.7.1

v1.7.0 shipped the base file with bare relative paths. PHPStan resolves a relative
path against the directory of the config that declares it, so lib there meant
vendor/conduction/hydra-gates/quality-config/lib and the run aborted before
analysing anything. v1.7.1 prefixes every path with %currentWorkingDirectory%/.
composer.lock is regenerated for that one package; nothing else moved.

How it was verified

phpstan dump-parameters was captured on both sides in a PHP 8.3 container. The five
load-bearing keys — level, paths, excludePaths, bootstrapFiles, scanDirectories —
resolve byte-identically, same sha256 over the extracted block. The analysis ran over
200 files before and 200 files after, with 0 findings before and 0 after.
The remaining difference in the full parameter dump is the extra ignore patterns the
base contributes (ContextChat, SystemTag, Bookmarks), which can only suppress, never
add.

The method was positive-controlled on the first app migrated: dropping an app-local
ignore makes real errors appear, and adding an entry under paths moves the resolved
key — so a byte-identical comparison here is a result, not an instrument that reports
"same" whatever it is fed.

Scope

Only PHPStan files. phpmd.xml, stylelint and prettier are untouched here; a
separate change covers those.

[github-actions]

Quality Report — ConductionNL/decidesk @ 2f540a0

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 104/104
npm			✅	✅ 548/548
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-12 21:32 UTC

Download the full PDF report from the workflow artifacts.