[TASK] Declare the direct dependencies each package uses

[CybotTM]

Implements the mechanical half of #1355; everything that needs a decision stays there.

Problem

Every split package uses libraries in its production code without requiring them; this changes the nine where the missing entry needs no decision. The classes resolve inside the monorepo because the root pulls everything in together, but every packages/* directory is published as its own Composer package, and there the metadata is wrong. phpdocumentor/filesystem is the clearest case: it ships a FlySystemAdapter built on League\Flysystem and Flyfinder, and requires neither.

What this adds

27 declarations across nine packages. Every library added here is already installed transitively today, so no consumer loses a resolution, and the constraints follow what this repository declares elsewhere. Existing entries keep their order; nothing is re-sorted.

Package	added
filesystem	league/flysystem, phpdocumentor/flyfinder
guides	league/uri-interfaces, psr/clock, psr/container, symfony/http-client-contracts
guides-cli	doctrine/deprecations, league/tactician, phpdocumentor/filesystem, phpdocumentor/flyfinder, psr/clock, psr/container, psr/event-dispatcher, webmozart/assert
guides-code	twig/twig
guides-graphs	symfony/http-client-contracts, webmozart/assert
guides-markdown	symfony/string
guides-restructured-text	phpdocumentor/flyfinder, symfony/string
guides-theme-rst	symfony/polyfill-mbstring, twig/twig
dev-server	guzzlehttp/psr7, psr/event-dispatcher, ratchet/rfc6455, react/event-loop, symfony/event-dispatcher-contracts

The one entry that is not simply a library the code imports: guides-theme-rst calls mb_str_pad() in RstTheme/Twig/RstExtension.php:154, which PHP provides only from 8.3 while the package allows ^8.1. symfony/polyfill-mbstring supplies it from v1.28 and already arrives through symfony/string and twig/twig; this declares it. Verified by installing the package standalone in a PHP 8.1 container.

psr/log was #1354, which has since merged; this branch is rebased on top of it and both columns above are measured against that main.

Verification

Measured, not assumed. Every package was copied out, installed standalone with autoload-dev and require-dev removed, and checked with composer-require-checker — once against main and once against this branch, so both columns share one baseline:

Package	on main	on this branch
dev-server	8	0
guides-cli	16	4
guides-theme-rst	11	6
filesystem	16	6
guides	26	21
guides-graphs	12	9
guides-restructured-text	28	25
guides-code	11	9
guides-markdown	10	9
guides-theme-bootstrap	6	6

guides-theme-bootstrap is unchanged because its only gap is the Symfony config and container pair, which stays in #1355. Every symbol still listed elsewhere belongs to a decision item there, to psr/log from #1354, or to docblock pseudo-types that belong in composer-require-checker.json.

Note for anyone re-running this: the composer-require-checker version pinned in .phive/phars.xml, 3.5.1, aborts on symfony/config v8 with a parse error and produces empty output that reads like a pass. These numbers come from composer-require-checker 4.24.0.

Full suite 828 tests, no failures, also with --prefer-lowest. PHPStan and PHPCS clean. composer validate --strict passes for the root and every package.

Assisted by claude-code:claude-fable-5 — Session