Finish audit process cleanup: retire extract() idiom, harden cache flushing

[lisachenko]

Summary

The remaining process-cleanup items from the PHP 8.5 audit (one commit).

• FilterInjectorTransformer::rewrite(): the static $appDir, $cacheDir, $debug; locals populated via extract(self::$options, EXTR_IF_EXISTS) are replaced with typed array reads of the set-once self::$options (KernelOptions shape guarantees the keys) — analyzable by PHPStan, no variable materialization magic.
• MagicConstantTransformer: the duplicated constructor / on-demand path bootstrap is deduplicated into one configurePaths() helper; behavior identical (the on-demand path is still required because resolveFileName() runs from woven code where no transformer object exists).
• CachePathManager: pending cache records are now flushed from a shutdown function registered at construction, which runs while the runtime environment is still fully intact — instead of relying solely on __destruct(), whose ordering during shutdown is unspecified. The destructor remains as a safety net for managers released mid-request, and both teardown paths go through flushSilently(): an exception escaping a destructor or shutdown callback would be fatal, while losing one cache write just means the next request re-weaves. Explicit flushCacheState() calls keep their normal error behavior.
• SourceTransformingLoader's set-once statics were reviewed and left as-is: a PHP stream filter is instantiated by the engine itself, so static collaborators wired in ensureRegistered() are inherent to the mechanism, and they are already typed and documented.

Issue #618 (lazy-ghost evaluation for constructor interception) is deliberately not part of this PR — it stays open as a decision item with an evaluation plan on the issue.

Test evidence

Gate	Result
php8.5 vendor/bin/phpunit	OK — 2584 tests, 3147 assertions
php8.4 vendor/bin/phpunit	OK — 2584 tests, 10 skipped (8.5-only)
php8.5 / php8.4 vendor/bin/phpstan analyze (level 10)	No errors
php8.6 vendor/bin/phpunit (informational, 8.6.0beta2)	OK — 2584 tests

Fixes #610