[rootsiemen]

Closes #1183

What changed

ServerWorker::createSslContext() now verifies that local_cert and local_pk form a matching, parseable pair before the worker starts: the certificate must parse as X.509 (openssl_x509_read), the key must parse as a private key (openssl_pkey_get_private), and the two must match (openssl_x509_check_private_key). Any failure throws InvalidArgumentException naming the file path(s), matching the existing TLS config error style. The existing path/symlink/readability checks are unchanged.

Why

A mismatched or unparseable pair previously passed config validation and failed later in Workerman listen() with a low-level RuntimeException, after the worker had already started booting.

Tests

• New ServerWorkerTest cases (fixtures generated in-test with PHP openssl functions, following the existing generateSelfSignedCert helper): valid pair (existing testHttpsWorkerUsesSslTransportAndTlsContext), mismatched pair, garbage certificate, garbage key.
• Reproduced first: all 3 new tests failed on pristine master (no exception thrown); after the fix they pass.
• vendor/bin/phpunit --no-coverage tests/ServerWorkerTest.php: 47/49 pass. The 2 failures (testUnreadableCertThrowsException, testUnreadableKeyThrowsException) are pre-existing in this environment: running as root, is_readable() is true even for chmod-0000 files, so the same 2 tests fail on pristine master too (verified via git stash).
• composer lint: php-cs-fixer, PHPStan level 8, Rector, kb-lint, check-changelog, check-exception-usage all pass. shellcheck flags a pre-existing info note in bin/worktree-done.sh (untouched shared script) and hadolint is not installed in this environment, so the lint script reports those two steps as failed; neither is caused by this change.
• CHANGELOG entry added under [Unreleased] → Fixed ([Bug] ServerWorker does not verify local_cert/local_pk form a matching, parseable pair #1183).