Update phpunit/phpunit to fix CVE-2026-24765

[AaronAtDuo]

Summary

• Updates phpunit/phpunit from 9.6.8 to 9.6.34, fixing CVE-2026-24765 (unsafe deserialization in PHPT code coverage handling, CVSS 7.8 High)
• Pins doctrine/instantiator to 1.x to maintain PHP 8.2 compatibility (2.x uses typed constants requiring PHP 8.3+)

Test plan

• Unit tests pass on PHP 8.2 (56 tests, 92 assertions)
• Unit tests pass on PHP 8.3 (56 tests, 92 assertions)
• CI pipeline passes across full PHP matrix (8.2, 8.3, 8.4, 8.5)

🤖 Generated with Claude Code

[jeffreyparker]

My (limited) understanding is that the composer.json should be updated with the new constraint, then composer update should auto-generate this lockfile. Do we need to also add the composer.json to this PR?

[AaronAtDuo]

Good catch — the ~9 constraint already allows 9.6.34 so the lock file update works, but you're right that we should also tighten the constraint in composer.json to ~9.6.33 to prevent installing vulnerable versions. I'll update the PR.