fix: stabilize coverage and release detection

[roncodes]

Summary

Fix the two independent failures encountered after merging the 1.3.0 release PR.

• Pin Xdebug 3.5.3 in coverage, mutation, and release validation, and fail if a different driver is loaded. Keep the 100% line/branch and 85% mutation gates unchanged.
• Replace the single release-PR lookup with six attempts, ten seconds apart. Handle paginated results and transient API failures, require an exact merge SHA and main target, reject ambiguous matches, and warn explicitly when no release PR appears.
• Add 11 offline detector regression tests to CI and preserve coverage artifacts on gate failures.
• Document recovery without manually creating tags or bypassing the protected release environment.

Evidence and validation

The passing PR and failing main run have identical source trees. The passing coverage run used Xdebug 3.5.3; the failing run loaded 3.6.0alpha1 and reported 51.49% branch coverage while all tests and line coverage passed. The separate release workflow skipped publication because GitHub had not yet returned the merged release PR; the API now associates the same commit with PR #11.

Local validation:

• 11/11 release-detector regression tests passed, including delayed metadata, final retry, pagination, API failures, invalid versions, historical PRs, and ambiguity.
• Read-only detector invocation resolved the real 1.3.0 merge to PR Release 1.3.0: Trailers API and equipment attachments #11.
• PHP 8.3.13 / Xdebug 3.5.3: 37 tests, 4,628 assertions; 100% lines and branches.
• PHP lint, formatting, static analysis, unit tests, 264-request contract generation, license checks, and all public API compatibility baselines passed. Local static analysis required a 1 GB memory override.
• actionlint, shellcheck, and git diff checks passed.
• GitHub CI results will provide runner-side verification of the driver pin and mutation gate.

Release handling

No source API behavior, dependency lock, version, or published tag changes. This is a normal fix branch and does not itself qualify as a release branch. After these repairs are merged, the still-unpublished 1.3.0 needs a fresh reviewed release PR containing the repaired workflow; rerunning the old run uses its original workflow. Publication remains behind the existing validation and release environment gates.

Related runs: https://github.com/fleetbase/fleetbase-php/actions/runs/34431966656 and https://github.com/fleetbase/fleetbase-php/actions/runs/34431966856