feat: PHP output-buffering builtins (ob_*) with user handlers, chunk auto-flush, and flags gating

[nahime0]

Implements PHP's complete output-control surface — all 13 ob_* builtins — in both the AOT path and the Magician eval()
runtime, with one shared buffer stack across static and eval'd code.

What's included

Buffer stack (runtime)

• Heap-backed 64-level buffer stack with doubling growth; capacities follow PHP's shape (16384 default, page-aligned chunk_size + 1 when chunked).
• Capture hooks into __rt_stdout_write; the remaining raw write(1, …) bypasses (printf/vprintf, the var_dump walkers,
  readfile/fpassthru streaming loops) now route through a register-preserving shim so every stdout writer is captured.
• Closures, first-class callables, function-name strings, and boxed Mixed callables run on flush/clean with PHP's exact phase
  bits (WRITE/CLEAN/FLUSH/FINAL + START on first run — values verified against PHP 8).
• false return passes the raw contents through; any other return is cast to a string. ob_get_clean/ob_get_flush return the
  RAW contents while the handler output is flushed/discarded, like PHP.
• Output produced inside a handler is discarded; ob_start() inside a handler is a fatal error, matching PHP.
• Handlers registered inside eval() are invoked from runtime flush points (including static-code flushes and the script-end
  drain) through an installed magician hook, mirroring the dynamic-destructor precedent.

PHP-parity semantics

• chunk_size auto-flushes at the threshold with the WRITE phase.
• flags gate operations exactly like PHP (ob_clean ← CLEANABLE, ob_flush ← FLUSHABLE, end/get ← REMOVABLE), with PHP's
  E_NOTICE texts (including the dynamic … buffer of NAME (LEVEL) forms) routed through the capture funnel so parent buffers see
  them.
• Invalid callbacks raise PHP's warning + "Failed to create buffer" notice and return false.
• ob_get_status() reports handler name/type/flags (user bit, started/processed bits after the first run), chunk size, and buffer
  sizes; ob_list_handlers() reports per-level handler names.

Known divergences (documented in docs/php/system-and-io.md)

• The first-class callable of a named function reports that function's name in ob_get_status/ob_list_handlers (PHP reports
  Closure::__invoke); anonymous closures report Closure::__invoke correctly.
• Array-pair callables ([$obj, 'method']) are rejected at compile time in AOT (supported in eval).
• A builtin name as handler follows the runtime-callable builtin allowlist; PHP fatals on arity instead.

Related

• Found and filed Untyped functions reachable only via dynamic callables get Int-defaulted params: returned strings silently become int(0) #576 while testing: untyped functions reachable only through dynamic callables get Int-defaulted params,
  silently corrupting string returns. Pre-existing on main, independent of this branch; the ob handler tests use typed handlers
  where it matters.

Testing

• 44 end-to-end codegen tests (capture, nesting, handlers across all callable shapes, chunk thresholds, per-flag gating with
  notices, status/handler introspection, eval↔static interop, script-end/exit drains, print_r/printf/var_dump/readfile/fpassthru
  capture).
• 8 diagnostics tests, 6 magician interpreter tests, cross-registry parity gates green (signatures identical in both registries).
• Behavior pinned against real PHP 8 output byte-for-byte where applicable (phases, notices, status fields, chunk buffer sizes).
• Generated builtin docs/registry regenerated (update-builtin-docs); example in examples/output-buffering/.