Do not silently discard recorded activity input during dependency injection #910

Problem

After an activity signature changes, Laravel dependency resolution can discard
its recorded business argument and execute the activity with a newly constructed
DTO's defaults. The run then records successful completion with the wrong data.
This was reproduced while qualifying website#363, rather than inferred from
its documentation report.

Published reproduction

Normally installed Workflow 2.11.2, source
a730773a3dcdf4c6d4ea0297f6c9010ccc0603f9; PHP 8.5.12, Laravel
13.38.0, SQLite. Real package migrations, workflow/activity jobs and durable
history are used. Queue transport is faked so those public jobs can be driven
explicitly. Execution crosses two fresh PHP processes; no service SDK or native
Server behavior is inferred.

1. The first process starts a workflow with 7. Its workflow task records an
   activity with positional arguments [7], then stops before that activity.
   The original activity is:

   final class QuoteActivity extends \Workflow\V2\Activity
   {
       public function handle(int $amount): array
       {
           return ['amount' => $amount];
       }
   }

2. A fresh process loads the same original database and the same activity class
   identity with this changed definition:

   final class QuoteRequest
   {
       public function __construct(public int $amount = 0) {}
   }
   
   final class QuoteActivity extends \Workflow\V2\Activity
   {
       public function handle(QuoteRequest $request): array
       {
           return ['amount' => $request->amount];
       }
   }

3. Execute its original ready activity task, then the original parent task.
   The recorded arguments still decode to [7], with SHA-256
   73ab292f3f07ffff5c58d9a88b09cf78a3a2b7490f9011dd10a0d33ed84d4536.
   The activity and workflow nevertheless complete with amount: 0.

Actual original run 01m5kr1j590a3vcc3j0hh7meat: one activity attempt,
three first-attempt tasks, zero repairs, and exactly
StartAccepted → WorkflowStarted → ActivityScheduled → ActivityStarted → ActivityCompleted → WorkflowCompleted.
There is no failure or input-mismatch diagnostic. An assertion requiring the
original amount 7 fails against actual 0.

Independent controls on the same published package pass: adding a trailing
optional activity argument uses its default; a new workflow reader can consume
an old result with a field fallback. Adding a required argument records
ArgumentCountError/ActivityFailed, and reading a missing old result field
records an application failure. Those outcomes are separate from this silent
DTO substitution.

Cause and acceptance

RunActivityTask
resolves method dependencies before invoking the activity. The container inserts
a default DTO ahead of the recorded scalar; the scalar becomes an extra PHP
argument and is silently unused. This is the activity counterpart of the entry
safety concern fixed for workflow methods in #866.

• Refuse binding that would silently replace or discard recorded activity input
  before application activity code or its side effects run.
• Keep original input, run/activity/task identities and committed history intact.
  Define a typed, inspectable mismatch outcome and a supported recovery path
  after compatible code is restored; do not invent a successful result.
• Preserve legitimate dependency-injected services, scalar input, optional
  trailing defaults, variadics and supported input adapters.
• Add a failing-before regression using the real activity job, with cold
  persisted input plus valid DI/default controls. Cover supported SQL backends.
• Verify the affected published embedded consumer and document the resulting
  compatibility/recovery contract in website#363 and all offered locales.
  Check PHP service-mode binding independently before claiming it affected or
  fixed. Native/shared parity stays coordinated with its owner.

Current delivery

Published 2.11.3 at 71213ae1 after exact candidate and independent main checks passed. Normally installed cold-process refusal and same-original authored-retry recovery pass, with the old 2.11.2 originals retained as failures. Full receipt. Published Laravel/PHP profile 39933343761 passes all seventeen jobs. Website #363 / PR #379 is delivered in all eight locales (receipt6362864678). Sample #275 is delivered at 40be451c after all candidate/main checks and anonymous both-registry amd64/arm64 image verification. The affected PHP Server package/image pin remains a separate qualified-release follow-through, with no native or Cloud adoption inferred.