fix(quality): install PHPUnit sibling apps on the PHP the leg tests on

.github/workflows/quality.yml

@@ -3603,6 +3603,41 @@ jobs:
           # and the depth silently stays 1.
           fetch-depth: 0
 
+      # Setup PHP runs BEFORE the sibling installs below, as it already does in
+      # the newman, playwright and journeydoc-capture jobs. The other way round,
+      # `composer install` for a sibling app ran on the runner image's system PHP,
+      # not the PHP this leg tests on, and checked the sibling's lock against
+      # extensions the suite never loads. Measured on keepiq development
+      # (run 34948398659, 2026-09-15): the image's ext-redis 5.3.7 conflicts
+      # with symfony/cache v7.4.14 in integriq's lock, so all six cells failed
+      # at this install, while integriq's own CI installed the same lock after
+      # Setup PHP without complaint. A sibling must install on the PHP the leg
+      # runs, so that a lock that cannot is a real finding and not the image's.
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          # pdo_mysql joins the list unconditionally: setup-php installs
+          # extensions per leg, and a leg that does not use MySQL pays only the
+          # install cost. Making it conditional would mean a mysql leg silently
+          # falling back to the else-branch of the install below and testing
+          # sqlite while its name said mysql.
+          #
+          # xdebug-3.5.3 IS A PIN, NOT CLUTTER. `coverage: xdebug` alone enables
+          # whatever Xdebug the packaged PHP carries, and between 2026-09-09 and
+          # 2026-09-10 that became Xdebug 3.6.0alpha1 on both PHP 8.3 and 8.4
+          # (PECL's newest release is still 3.5.3). The openregister suite went
+          # from ~3.5 min to ~39.6 min under it (about 12x: jobs 102466575014
+          # vs 102811468997), so every PHPUnit leg hit the 45-minute cap and
+          # was cancelled. setup-php runs `extensions` before `coverage`, so
+          # this builds 3.5.3 from PECL first and `coverage: xdebug` then finds
+          # it loaded and keeps it.
+          # Lift the pin only once Xdebug 3.6 is STABLE and a PHPUnit leg has
+          # been measured to be no slower under it than under 3.5.3.
+          extensions: mbstring, intl, sqlite3, pgsql, pdo_pgsql, mysqli, pdo_mysql, zip, gd, curl, xml, json, xdebug-3.5.3
+          coverage: xdebug
+          tools: composer:v2
+
       - name: Checkout additional apps
         if: ${{ inputs.additional-apps != '[]' }}
         run: |
@@ -3693,31 +3728,6 @@ jobs:
             fi
           done
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-version }}
-          # pdo_mysql joins the list unconditionally: setup-php installs
-          # extensions per leg, and a leg that does not use MySQL pays only the
-          # install cost. Making it conditional would mean a mysql leg silently
-          # falling back to the else-branch of the install below and testing
-          # sqlite while its name said mysql.
-          #
-          # xdebug-3.5.3 IS A PIN, NOT CLUTTER. `coverage: xdebug` alone enables
-          # whatever Xdebug the packaged PHP carries, and between 2026-09-09 and
-          # 2026-09-10 that became Xdebug 3.6.0alpha1 on both PHP 8.3 and 8.4
-          # (PECL's newest release is still 3.5.3). The openregister suite went
-          # from ~3.5 min to ~39.6 min under it (about 12x: jobs 102466575014
-          # vs 102811468997), so every PHPUnit leg hit the 45-minute cap and
-          # was cancelled. setup-php runs `extensions` before `coverage`, so
-          # this builds 3.5.3 from PECL first and `coverage: xdebug` then finds
-          # it loaded and keeps it.
-          # Lift the pin only once Xdebug 3.6 is STABLE and a PHPUnit leg has
-          # been measured to be no slower under it than under 3.5.3.
-          extensions: mbstring, intl, sqlite3, pgsql, pdo_pgsql, mysqli, pdo_mysql, zip, gd, curl, xml, json, xdebug-3.5.3
-          coverage: xdebug
-          tools: composer:v2
-
       - name: Install Nextcloud
         run: |
           cd server