fix(docs-vec): make the hybrid driver buildable and runnable on stock PHP

[markshust]

Summary

The docs-vec audit (#128) flagged six defects plus a presumed structural wall — "PDO can't load SQLite extensions on stock PHP." The wall was a wrong API call, not a platform limit: Pdo\Sqlite::loadExtension() works on stock Homebrew PHP 8.5. Every defect turned out to be code/packaging, and the driver is now functional end-to-end.

Fixes (closes #128)

1. Double-binding boot crash — module.php bound DocsSearchInterface in both bindings and singletons → BindingConflictException. Now bindings => [] + singleton factory.
2. Unautowireable $packageRoot — VecRuntime + the download commands now registered as singletons with __DIR__.
3. 128 MB OOM — DownloadModelCommand streams the ONNX model to disk (stream_copy_to_stream).
4. Missing sqlite-vec binary — new docs-vec:download-extension command: pinned v0.1.9, SHA-256-verified before extraction, fail-closed, per-platform (macOS/Linux/Windows × x86_64/arm64).
5. Wrong/suggest-only transformers — codewithkyrian/transformers-php → codewithkyrian/transformers (^0.5 || ^0.6); kept optional with graceful FTS5-only fallback when extension/model/transformers are absent.
6. Structural (decisive) — VecRuntime now loads sqlite-vec via Pdo\Sqlite::loadExtension() instead of the blocked SELECT load_extension(...), with a probe that degrades to FTS5 on builds that compile the capability out.

Plus latent bugs the never-run embedding path hid: HF model layout (onnx/ subdir + tokenizer files), pipeline() usage + mean-pooling, per-call model reload (the indexing OOM), vec0 integer-PK bind. The FTS half now sanitizes NL queries (parity with #127), co-located because marko/docs is contract-only.

Verification

• Real hybrid build over the docs corpus → all 8 expected docs in top-3 (V = 8/8), matching docs-fts.
• 89 passed / 6 skipped / 0 failed across docs, docs-fts, docs-vec. phpcs + php-cs-fixer clean.
• Downloaded binary/model are gitignored; root composer.json untouched.

docs-fts remains the recommended zero-infra default; docs-vec is now a working opt-in semantic option.

🤖 Generated with Claude Code