[Copilot]

Move the project from PHP 8.2 to 8.4. Also fix the two runtime deprecations in the app code: E_USER_ERROR passed to trigger_error, and fputcsv without an explicit $escape argument.

• Version bump

  • .docker/php/Dockerfile: php:8.4-apache, and xdebug 3.3.1 → 3.4.5 (3.3.x doesn't support 8.4)
  • .circleci/config.yml: cimg/php:8.4-browsers (image tag only)
  • app.yaml: runtime: php84
  • README.md, copilot-setup-steps.yml, copilot-instructions.md and the dependabot skill doc now say 8.4
  • rector.php is still on php82: true on purpose, so Rector doesn't start rewriting code in this PR

• E_USER_ERROR → E_USER_WARNING

  • Nine trigger_error calls, in include/people.php, include/stock_edit.php, library/lib/auth0.php (2), library/lib/errorhandling.php, library/ajax/testdbdelete.php (2), library/functions.php and cron/dailyroutine.php
  • The error still reaches Sentry through boxwise_error_handler_class

• fputcsv: both calls in cron/reseed-roles-auth0.php now pass ',', '"', '' explicitly

- trigger_error($msg, E_USER_ERROR);
+ trigger_error($msg, E_USER_WARNING);

- fputcsv($fp, array_values($role));
+ fputcsv($fp, array_values($role), ',', '"', '');

Reviewer notes

• Execution flow changes. E_USER_ERROR with PHP's default handler aborts the script, so the code after each call (throw, $return = 'false', redirect(), logoutWithRedirect()) was effectively unreachable. With E_USER_WARNING that code now runs.
  • For example, mobile_distro_check now redirects after logging.
  • The dailyroutine loop now checks every Auth0 user instead of stopping at the first mismatch.
  • Please confirm this is the intended behaviour at each call site.
• CSV escaping. The empty $escape follows RFC 4180. A backslash inside a value is no longer treated as an escape character. This only matters if a role name contains one.
• Dependencies. The locked set installs under an 8.4 platform with no conflicts. These packages raise "implicitly nullable parameter" deprecations on 8.4. The notices are harmless today, but several packages are pinned or blocked by security advisories and can't be bumped in this PR:
  • google/cloud-core
  • google/cloud-datastore
  • google/cloud-error-reporting
  • google/cloud-logging
  • opencensus/opencensus
  • sendgrid/sendgrid
• Abandoned packages. opencensus/opencensus and opencensus/opencensus-exporter-stackdriver are abandoned.