release: validate composer.json (the PIE/Packagist manifest)

Distribution is PIE/Packagist, which read composer.json, but the release gate
only validated package.xml (the pecl build helper). Add `composer validate
--strict --no-check-publish` so a broken manifest fails the release. Add
composer to the setup-php tools.

(PIE install itself resolves from Packagist by package name, so it can't be
exercised pre-publish in the same run; composer validate is the meaningful
pre-tag gate for that channel.)

https://claude.ai/code/session_017skw8BsHkF8wur7Pf4G9W5

Author: claude

.github/workflows/release.yml

@@ -33,11 +33,11 @@ jobs:
             exit 1
           fi
 
-      - name: Set up PHP with pecl/pear
+      - name: Set up PHP with pecl/pear and composer
         uses: shivammathur/setup-php@v2
         with:
           php-version: '8.3'
-          tools: pecl
+          tools: pecl, composer
 
       - name: Check version metadata is in sync with the tag
         run: |
@@ -51,9 +51,14 @@ jobs:
             exit 1
           fi
 
-      - name: Validate package.xml
+      - name: Validate package.xml (PECL build helper)
         run: pecl package-validate
 
+      - name: Validate composer.json (PIE / Packagist manifest)
+        # PIE and Packagist read composer.json, so it gates the actual
+        # distribution channel. --strict also fails on warnings.
+        run: composer validate --strict --no-check-publish
+
       - name: Build and run the full CI test suite
         # Reuse the same script the build matrix uses: it runs the phpt suite
         # (when run-tests.php is available) plus the OOM-hook / safe_read /