[larspohlmann]

Closes #19

Teaches phptramp to tell idiomatic object construction and delegation apart from
tramp data. Two independent changes, plus one prerequisite refactor.

1. parent:: delegation is not a hop and not a class

A subclass constructor forwarding to parent::__construct() is inheritance
wiring on the same object, not a value crossing a collaborator boundary — so
a node that forwards through any parent:: call now counts toward neither the
hop score nor the class count. It stays visible in the rendered chain, marked
(parent) in text/pretty and "viaParent": true in JSON, so nothing is hidden;
it just stops accumulating score. self::/static:: are unaffected — same
class, ordinary hop.

A three-deep exception hierarchy now scores 0 hops across 1 class and is
reported by no formatter. This is what removed "one finding per custom
exception" from the report.

One conditional worth knowing: the delegator's class is skipped only when the
base it delegates into is actually present in the chain. When that base is
outside the analyzed index — class ThinException extends \RuntimeException —
nothing downstream represents it, so its class is counted. Otherwise the header
would say "1 class" above a chain visibly listing two, and --min-classes 2
would silently drop findings it used to report.

This amends frozen rule 4 in docs/plan.md.

2. --exclude-terminal <kind> / excludeTerminals

An opt-in denylist filtering findings by TerminalKind, repeatable on the CLI
and available as a config key. Default [] — nothing excluded, so no existing
output moves. It unions with the config list rather than replacing it (config is
project policy; a one-off CI run adds to it), which is deliberately the opposite
of the path flags. Validation lives in exactly one place and runs before the
index build, so a typo fails fast with exit 2.

What this deliberately does NOT do

Issue #19's own noisy example is not silenced by default. begin →
persistedLog → new RunLog is a stored terminal with no parent:: anywhere,
so this branch does not change its output unless you opt into
--exclude-terminal stored.

That is an argued rejection, not an oversight. The issue proposed that stored
terminals should not be findings by default. But the README's own headline
finding — $config forwarded through a controller and two services into
new Mailer($config) — is a stored terminal, as are 7 of the 21 findings
across tests/fixtures/. The issue's noisy example is 2 hops across 2 classes;
the README's legitimate one is 3 hops across 4 classes. Both are stored, so
terminal kind is not what separates them — hop count is. Excluding stored by
default would delete the tool's canonical finding. The rationale is recorded in
docs/plan.md's appendix so it does not get re-proposed.

Prerequisite refactor

Finding::$hops was doing double duty as the hop score and the index of the
terminal node inside Finding::$chain; five reporters read it as an index.
Changing what the score counts would have silently broken all five, so the first
commit severs that: TerminalKind::keepsTerminalNode() answers the structural
question, and hops becomes purely a score.

Verification

• composer check green: PHPCS, PHPStan level max, PHPMD, 526 tests / 1737 assertions.
• composer infection:diff MSI ~94.9% against the minMsi 80 gate.
• 4 new fixtures (parent-delegation-hierarchy, parent-delegation-mixed,
  parent-delegation-external-base, exclude-terminal-stored); every
  pre-existing fixture and reporter expectation is unchanged, which is the
  evidence that the default behaviour did not move.