v13 baseline — drop L10/11 + PHP 8.2, add Laravel 13, bump CI matrix

[qschmick]

Summary

Mechanical version-bump PR for the v13.0 release line. No src/ changes. No test-framework changes. Everything else follows:

• PHP floor: 8.3 (dropped 8.2).
• Laravel: 12.x and 13.x (dropped 10.x, 11.x).
• Testbench: ^10.0|^11.0 (dropped 8, 9).
• PHPUnit: ^11.0|^12.0 (dropped 10). Still present — PR 3 swaps to Pest.
• CI matrix: PHP {8.3, 8.4} × Laravel {12, 13} × dependencies {prefer-lowest, prefer-stable} = 8 blocking combos. PHP 8.5 × same = 4 non-blocking experimental combos.
• README: compat matrix expanded to reflect all supported Totem majors.

Resolved versions (local, 2026-04-21, PHP 8.4 / prefer-stable)

• laravel/framework: v13.6.0 (Laravel 13 stable)
• orchestra/testbench: v11.1.0
• phpunit/phpunit: v12.5.23
• illuminate/support: v13.6.0 (via laravel/framework)

Symfony transitives bumped 7.4 → 8.0; laravel/tinker v2 → v3. No direct use in src/; all tests pass.

Laravel 13 upgrade-guide citations

Per spec §2.1, these upgrade-guide sections were walked to verify no breaking changes to Totem's integration points:

• Service-provider auto-discovery (extra.laravel.providers unchanged): https://laravel.com/docs/13.x/upgrade#package-discovery
• Illuminate\\Support\\Js (used in v12.0.2 popup fix, forward-ported on 13.x): https://laravel.com/docs/13.x/upgrade#strings — cross-ref https://github.com/laravel/framework/blob/13.x/src/Illuminate/Support/Js.php
• Schedule::command() + ->thenWithOutput() (used in `src/Providers/TotemServiceProvider.php::scheduleTotemTasks`): https://laravel.com/docs/13.x/upgrade#scheduling — cross-ref https://github.com/laravel/framework/blob/13.x/src/Illuminate/Console/Scheduling/Event.php
• Notification channel contracts (`src/Notifications/TaskCompleted.php`): https://laravel.com/docs/13.x/upgrade#notifications

If any of these anchors have re-anchored by review time, the PR body needs updating — flag it.

CI matrix

Blocking (8 combos): PHP 8.3/8.4 × Laravel 12./13. × prefer-lowest/prefer-stable.

Non-blocking experimental (4 combos): PHP 8.5 × Laravel 12./13. × prefer-lowest/prefer-stable. `continue-on-error: true` is gated by `matrix.experimental` (default `false`, overridden to `true` in the include entries).

The `prefer-lowest` lanes include a floor-verification step that queries `composer show laravel/framework --format=json`, extracts the resolved version, and fails the lane if it's below the declared Laravel major floor (12.0.0 / 13.0.0). `set -euo pipefail` is enabled so empty pipelines fail loudly. Verified locally against both L12 prefer-lowest (resolved 12.1.1) and L13 prefer-lowest (resolved 13.0.0) — both pass the check.

Test plan

• `composer validate --strict` clean.
• `composer update --prefer-dist` resolves cleanly against Laravel 13.x stable locally.
• Full PHPUnit suite green locally on Laravel 13.6.0 / prefer-stable / PHP 8.4 (79 tests / 522 assertions).
• Floor-verification step manually simulated for L12 and L13 prefer-lowest resolutions.
• CI blocking matrix (8 combos) green.
• CI experimental PHP 8.5 lanes run without blocking the merge.

Composer.lock note

`composer.lock` is gitignored in this repo (commit `e23f9fb` titled "fix : remove composer.lock") per library-package convention. The lockfile is regenerated by each consumer. CI's `composer update` exercises the fresh resolution.

Design spec

See `docs/plans/2026-04-21-totem-v13-release-design.md` §2 (Section 2: PR 2). ACs AC2.1–AC2.5.

Release plan

No release triggered by this PR alone. v13.0.0 is tagged after PR 5 (release prep). This PR is the first of four v13 PRs on `13.x` that precede the tag. Prerequisite for PR 3 (Pest migration) and PR 4 (type sweep).