#22 fix: correct the Symfony 6.4 support claim and harden the release gates

Why: the 4.0.0 archive ships a support statement that cannot be followed — it tells Symfony 6.4 applications to stay on the legacy 3.0 line, which requires symfony/validator ~2.1 and installs only on Symfony 2.x. All three reviewers of the post-release tail found it independently, and one reproduced the unsatisfiable Composer resolution with a probe project. The same review surfaced two gates that cannot fail when the invariant they guard is broken.

Changes:

• The plan document now states the truth: no released version of this bundle ever supported Symfony 6.4, so dropping it removed a target the package never served. The wrong claim replaced an equally wrong "1.x" reference during the 4.0 rename — one false statement had been swapped for another.
• The 4.0.0 changelog entry carries its release date; the published archive described itself as unreleased.
• failOnRisky is enabled. The kernel smoke teardown carries an invariant PHPUnit detects but only reported as a note, so the suite exited 0 while two tests were risky — exactly how the reverted beff109 passed locally.
• The archive gate requires the profiler template. It is a runtime dependency (the compiler pass registers the collector with @LuneticsTimezone/Collector/timezone.html.twig) but was only checked by the no-dev smoke script, which stats the source checkout and cannot observe an export-ignore mistake.

Verification: 204 tests / 843 assertions and PHPStan at max level green. The risky gate was proven rather than assumed: re-applying the reverted change makes the suite exit 1, reverting it returns exit 0. The Symfony 6.4 claim was falsified with composer update --dry-run on symfony/framework-bundle: 6.4.* + lunetics/timezone-bundle: ^3.0 → "Your requirements could not be resolved".

References: corrects 338d8ed (the 4.0 rename) · follows the review of b704355..338d8ed, the only range of #21 that no external model or bot had seen.

---

Summary by cubic

Fixes the false Symfony 6.4 support statement and strengthens release checks to prevent shipping missing runtime assets. Previously we told Symfony 6.4 apps to use the legacy 3.x line (which requires symfony/validator ~2.1 and only installs on Symfony 2.x); now the plan states no released version supports 6.4, and we enforce tests and archives accordingly.

• Docs: corrected the implementation plan; added a 4.0.1 changelog entry; dated the 4.0.0 entry.
• Tests: enabled PHPUnit failOnRisky; runs now fail if any test is risky.
• Distribution: archive gate now requires Resources/views/Collector/timezone.html.twig; releases fail if the profiler template is missing.

Summary by CodeRabbit

• Documentation

  • Clarified the bundle’s Symfony support policy, including Symfony 6.4 and legacy versions.
  • Updated release dates and documented recent maintenance corrections.

• Tests

  • Distribution checks now require the profiler’s timezone template.
  • Risky PHPUnit tests now cause the test suite to fail.