Use published PHP SDK 2.3.7 in Sample App

[rmcdaniel]

Change

Update the qualified tuple and both PHP lockfiles from 2.3.5 to published 2.3.7. Both locks resolve source and dist to 275b3bf5d82fa334e6ff1f5ba21e2b4dd55ddf78, with matching product-train metadata. No other package changes.

The release keeps Worker presence during query/activity loading and adds bounded, supervised external-payload loading for ordinary and cooperative Workers. SDK evidence: #151, stable qualification, published smoke.

Verification

• Normal Composer resolution of both lockfiles, strict validation and the artifact-graph check pass.
• Required before merge: ordinary repository checks, candidate image startup and the expanded published PHP/Python/Rust runtime matrix.
• Required after merge: fresh-main checks and both published image architectures, including installed PHP identity and the normal playground startup.

Affected installed SDK slow-transfer checks remain with the PHP SDK maintainer. This PR supplies Sample App follow-through for SDK #150 and #146. It makes no Cloud, native Server or pending Nexus qualification claim.

[rmcdaniel]

Sample #211 is delivered at 9d298b6161def330a2405288ee0164097ddec058. Its tree 7922b0d4896ecd63ee470fd3d106d46007a10302 matches reviewed head 074afdf29ef87785d71f97934a48cbdc7256f295 and the actual activity-recovery runner 8c950475b2603c25f802377ae56745a19941d92e.

• All 18 candidate checks pass, including the expanded published runtime matrix 38333728004.
• Activity recovery 38333728840 executes and reports all 45 cases passing across nine PHP/Python/Rust directions and retry, worker loss, total deadline, retry exhaustion and progress heartbeat scenarios. Original budgets remain unchanged. Retained original artifact.
• All ten fresh-main workflows pass, including installed published SDK namespaces, search attributes, updates, timers, children and image 38336265794.
• Native amd64 and arm64 image qualification passes, including actual installed PHP SDK and Laravel integration 2.3.7, startup/doctor and browser checks. GHCR and Docker Hub main indexes are published and checked.

Published multi-platform image digest: sha256:8721e00e1bc5e841df444fcad063929ee6030ddfd768d0c28c4b74c405b8bb3f at both ghcr.io/durable-workflow/sample-app-devcontainer and durableworkflow/sample-app-devcontainer. Immutable tag: sha-9d298b6161def330a2405288ee0164097ddec058-run-38336265794-1.

This tuple selects PHP 2.3.7, Python 2.5.9 and Rust 3.5.1 with Server 2.6.1 / embedded Workflow 2.5.12. Python 2.5.10 is a subsequent separate consumer update. It changes no Cloud or frozen rewrite tuple. The merged remote head is deleted and independently absent.