Run CI tests on PHP 8.4 instead of 8.2

[basi]

Summary

Update the CI test matrix to run on PHP 8.4 instead of PHP 8.2.

The codebase already ships PHP 8.4 fixes (changelog 2025-02-04, upstream kamilwylegala#83 merged as f9dc42f) and downstream consumers run this fork on PHP 8.4 in production, but CI has never actually exercised 8.4 — the highest version in the matrix was 8.2.

Changes

• .github/workflows/tests.yml: matrix include 8.2 × mysql → 8.4 × mysql. Resulting matrix: 8.0 × (mysql, pgsql, sqlite) + 8.4 × mysql.
• README.md: updated the stale "Github actions are running tests on PHP 8.0, 8.1." note to reflect the new matrix (it was already out of date vs. the actual 8.0/8.2 matrix).

Verification

• PECL mcrypt 1.0.7+ supports PHP 8.4 (1.0.9 supports up to 8.6), so the setup-php extensions step (mcrypt included) installs cleanly on 8.4.
• PHPUnit 9.6's convertDeprecationsToExceptions defaults to false, so new PHP 8.4 deprecation notices do not fail the suite.
• On this PR, the Install PHP with extensions step runs before Composer and validates the PHP 8.4 toolchain immediately; full test verification is blocked by the pre-existing Composer failure below.

Known CI status

• All matrix cells currently fail at Install Composer Packages due to the Composer >= 2.9 security-advisory policy (broken on main since Nov 2025, unrelated to this change — the fix lives in Bump PHPUnit to ^9.6.33 to fix CVE-2026-24765 (Dependabot alert #3) #21). Once Bump PHPUnit to ^9.6.33 to fix CVE-2026-24765 (Dependabot alert #3) #21 merges, re-running this PR's workflow will execute the full suite; no rebase is needed because PR CI runs on the merge ref.
• custom_tag in bump-version.yml is intentionally untouched: 1.2.0 is reserved by Backport view path containment check for CVE-2026-48820 #22 and a CI-only change needs no release. The resulting duplicate-tag failure of the Bump version workflow on merge is known and harmless (same as the build(deps): bump actions/checkout from 4 to 5 #18 merge).

🤖 Generated with Claude Code