[ddespinoza]

Summary

Closes #9. Required by APS-Conecta/gestion#239, which blocks APS-Conecta/gestion#184.

pack app
  default: require the built browser bundle
  php-only: require runtime PHP; refuse frontend manifests and bundles
  archive → checksums → existing signing and verification

Adds an explicit php-only workflow input, disabled by default. Server apps supply their PHP check through the existing build input.

Evidence

• Before: the extended existing packer self-test reports 31 checks, 3 failures.
  After: 31 checks, 0 failures, including PHP-only packaging and frontend refusal cases.
• ShellCheck, actionlint, zizmor and the community checker pass. The existing browser-app fixture runs in CI.
• Standards and Spec reviews: no findings; final delta makes the same refusal condition explicit for ShellCheck.

Merge Danger

Door: two-way

Blast Radius: publishing

Existing callers keep the default browser-bundle requirement. Artifact identity, deterministic packaging and signature checks retain their existing behavior.