[s2x]

What changed

The php compose service ran as root, so make cs / make test-unit wrote
root-owned .php-cs-fixer.cache / .phpunit.cache into the bind-mounted
worktree and broke host-side bin/lint.sh.

• docker-compose.yml: the php service runs as
  HOST_UID:HOST_GID (default 1000:1000) with HOME: /tmp, so caches,
  composer.lock and vendor/ belong to the host user. The root-only
  fdb-blobs mount was removed from php (it is unwritable as the host user
  and no test or documented loader path uses it); the five FDB services keep it.
• bin/worktree.sh writes HOST_UID/HOST_GID to .env.worktree;
  bindingtester.yml exports them before starting php in CI.
• README.md/AGENTS.md document the UID/GID contract and a one-time upgrade
  note for existing root-owned caches/vendor/ and old .env.worktree files.
• CHANGELOG.md records the fix.

Closes #161

How it was tested

• Fresh docker compose down -v && docker compose up -d; docker compose exec php id = host 1000:1000; HOME=/tmp; /app/fdb.cluster, caches and
  vendor/ writable as the host user; /var/fdb/blobs no longer mounted in
  php.
• make cs + make test-unit in the container, then host bin/lint.sh:
  pass. Reverse order (host lint, then container tests, then make cs, then
  host lint): pass.
• make test: 919 tests, 2480 assertions, 6 skipped.
• No root-owned files in the worktree (find . -user root empty).
• docker compose config -q, actionlint on both workflows,
  shellcheck bin/worktree.sh, git diff --check, bin/lint.sh pass.

Checklist

• Tests added or updated, and all checks pass
• CHANGELOG.md updated under [Unreleased]
• Documentation updated
• Everything is written in English
• The PR title is a Conventional Commit (fix: ...)