Fix CI: green PHPStan and the prefer-lowest / prefer-stable test matrix

Pre-existing failures unrelated to the Psl arg fix, surfaced now that the
suite runs to completion:

- StrictComparisonOfObjectsRule::processNode() must return
  list<IdentifierRuleError>; add ->identifier() so the builder yields one.
- basepath(): realpath() is string|false. Guard both calls so preg_match
  receives a string and the function never returns false.
- RestrictImplicitDependencyUsage test used Psl\Collection\Vector as the
  "undefined package" example, but php-standard-library is now a declared
  dependency (the rule itself uses Psl\Type), so Psl\ is an allowed
  namespace. Use SebastianBergmann\Diff\Differ — installed transitively via
  phpunit but not declared — which is genuinely an implicit dependency.
- Raise phpstan/phpstan floor to ^2.1.13: the rule implements
  RestrictedClassNameUsageExtension, added in 2.1.13, so prefer-lowest
  previously resolved 2.1.0 (missing the interface) and fatal-errored.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Robert van Steen

composer.json

@@ -20,7 +20,7 @@
     },
     "require": {
         "php": "^8.3",
-        "phpstan/phpstan": "^2.1",
+        "phpstan/phpstan": "^2.1.13",
         "php-standard-library/php-standard-library": "^4.0 || ^5.0 || ^6.0"
     },
     "require-dev": {

src/Rules/StrictComparisonOfObjectsRule.php

@@ -54,6 +54,7 @@ public function processNode(Node $node, Scope $scope): array
                             $rightTypeDescription,
                             $expectedType->describe(VerbosityLevel::typeOnly())
                         ))
+                            ->identifier('superscript.strictComparisonOfObjects')
                             ->build(),
                     ];
                 }

src/basepath.php

@@ -7,6 +7,10 @@ function basepath(): ?string
 {
     $real_path = realpath(__DIR__);
 
+    if ($real_path === false) {
+        return null;
+    }
+
     preg_match(
         "/.+\b(vendor\/.+)/",
         $real_path,
@@ -30,7 +34,7 @@ function basepath(): ?string
 
     $project_path = realpath(__DIR__ . DIRECTORY_SEPARATOR . $out);
 
-    if ( !file_exists($project_path . DIRECTORY_SEPARATOR . "composer.json") ) {
+    if ( $project_path === false || !file_exists($project_path . DIRECTORY_SEPARATOR . "composer.json") ) {
         return null;
     }
 

tests/Rules/RestrictImplicitDepndencyUsage/RestrictImplicitDependencyUsageTest.php

@@ -16,7 +16,6 @@
 use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\TestCase;
-use Psl\Collection\Vector;
 use Superscript\PHPStanRules\Rules\RestrictImplicitDependencyUsage;
 
 final class RestrictImplicitDependencyUsageTest extends PHPStanTestCase
@@ -65,6 +64,9 @@ public function it_can_be_restricted(string $class): void
 
     public static function restrictedCases(): \Generator
     {
-        yield 'class from undefined package' => [\Psl\Collection\Vector::class];
+        // sebastian/diff is installed transitively (via phpunit) but not
+        // declared in this package's composer.json, so a class from its
+        // namespace must be flagged as an implicit-dependency usage.
+        yield 'class from undefined package' => [\SebastianBergmann\Diff\Differ::class];
     }
 }