docs: state the bundle's worker-mode contract

[turegjorup]

Documentation only. Says what the bundle guarantees under a worker runtime, what it shares between requests and why, and what a consuming application has to do to hold up its end.

Changes

• New README section, Worker mode (FrankenPHP, Roadrunner): the no-request-data rule, a table of the three values shared on purpose and why each is safe, what a consumer's authenticator subclass must not hold, the stateful-firewall requirement, and a note on auditing it with igor-php.
• Changelog entry.

Why

The behaviour landed in #77 — getProvider() returning a fresh provider, the Guzzle client cached in its place — but the contract was only stated in the PR description and in code comments. A consumer deploying under FrankenPHP has no way to know from the README whether the bundle is safe there, and no statement of what their own authenticator must avoid, which is the part the bundle cannot enforce for them.

What it claims, and where that is pinned

Claim	Pinned by
getProvider() returns a fresh provider	testGetProviderReturnsAFreshInstance()
No request state survives onto the next provider	testNoRequestStateSurvivesOnTheNextProvider()
The HTTP client is shared per provider	testTheHttpClientIsReusedAcrossProviders()
A stateless firewall is named as such	testAStatelessFirewallIsNamedAsTheProblem()

The three shared values are the Guzzle clients, the derived callback paths, and the authenticator's logger. Nothing else in src/ holds non-readonly state.

Verified with igor-php

igor-php v0.9.5, a static analyser for worker-mode state leaks, run against src/:

Total unique service files: 23
✅ OK (Stateless):           20
❌ KO (Dangerous State):     3

Its four findings are exactly the three values documented here plus Bundle::getContainerExtension()'s lazy init — all build-time or deliberate, none a request-data leak. Full evaluation in the thread; it is not wired into CI in this PR.

One thing I could not do

CLAUDE.md is gitignored (.gitignore:23, /CLAUDE.md) and untracked, so it cannot go in a PR.

I have made the corresponding edits to my local copy — a Worker mode: services hold no request data section under Architecture, the same table of shared values, the rule for new code, plus fixes to two now-stale descriptions (supports() still said "triggers on state + code", and LoginController did not mention scopes or the PKCE verifier) and three new configuration invariants.

If that file is meant to be shared, say so and I will add the .gitignore change and the content to this PR. If it is deliberately local, the README section carries the same contract for consumers and nothing is lost.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.52%. Comparing base (54d406e) to head (88dda85).

Additional details and impacted files

@@            Coverage Diff             @@
##             develop      #79   +/-   ##
==========================================
  Coverage      99.52%   99.52%           
  Complexity       205      205           
==========================================
  Files             15       15           
  Lines            834      834           
==========================================
  Hits             830      830           
  Misses             4        4           

Flag	Coverage Δ
unittests	99.52% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.