Adopt committed PHAR release distribution

Switch distribution to a single tracked `builds/quickpay` PHAR used by Composer (`bin` now points to it), and move Laravel Zero to dev-only dependencies so runtime installs avoid the framework graph. Remove the custom release script/workflow and related quality build job, update release/contributor docs for the new manual signed-tag flow, and add architecture/feature test updates to enforce and accommodate versioned PHAR output.

Author: tehwave

.gitattributes

@@ -1,4 +1,5 @@
 * text=auto eol=lf
+/builds/quickpay -text
 /.agents export-ignore
 /.github export-ignore
 /.gitignore export-ignore

.github/workflows/build-release.yml

@@ -97,19 +97,3 @@ jobs:
           tools: composer:2.10.2
       - run: composer install --no-interaction --no-progress --prefer-dist
       - run: composer format:test
-
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
-        with:
-          persist-credentials: false
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
-        with:
-          php-version: '8.5'
-          coverage: none
-          tools: composer:2.10.2
-      - run: composer install --no-interaction --no-progress --prefer-dist
-      - run: composer build
-      - run: builds/quickpay --version
-      - run: builds/quickpay list --raw

.github/workflows/quality.yml

@@ -1,5 +1,7 @@
 /vendor
-/builds/
+# Packagist installs this one committed PHAR; every other build is generated.
+/builds/*
+!/builds/quickpay
 /.idea
 /.vscode
 /.vagrant

.gitignore

@@ -3,8 +3,8 @@
 ## Project
 
 This is a PHP 8.4+ command-line client for Quickpay, built with Laravel Zero 12.
-It targets Quickpay API v10. Composer installs the source package and `quickpay`
-launcher; GitHub releases additionally publish a generated standalone PHAR.
+It targets Quickpay API v10. Composer and GitHub releases distribute the same
+tracked standalone PHAR without installing Laravel Zero at runtime.
 
 Use `php quickpay` when running from source. See `README.md` for the public
 command reference and `skills/quickpay/SKILL.md` for the agent-facing usage
@@ -92,19 +92,15 @@ as security-sensitive. Include hostile and malformed inputs in their tests.
 
 ## Packaging
 
-`builds/` is ignored generated output. Do not commit a PHAR. After packaged
-runtime code, configuration, Composer inputs, the launcher, or `box.json`
-changes, run:
+`builds/quickpay` is the tracked Packagist binary. Other files beneath
+`builds/` are ignored generated output. Do not update the tracked release binary
+in an ordinary change. Develop and test from source with `php quickpay`.
 
-```bash
-composer build
-builds/quickpay --version
-builds/quickpay list --raw
-```
-
-Use `composer release:build -- 1.0.0` only for a versioned release candidate.
-Follow `RELEASING.md`; the GitHub workflow publishes artifacts without writing
-generated binaries back to the source branch.
+For a release candidate, run `composer verify`, then build with
+`php quickpay app:build quickpay --build-version=1.0.0 --no-interaction` and
+smoke-test `builds/quickpay`. Commit that one binary in the release pull request.
+Follow `RELEASING.md`; after `Quality` passes, maintainers sign the tag and
+manually publish that exact committed binary without rebuilding it.
 
 ## Verification
 

AGENTS.md

@@ -6,6 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+### Fixed
+
+- Packagist releases now install the bundled PHAR without Laravel Zero's
+  dependency graph, using a single Quality-gated release build, signed tag, and
+  manually published immutable GitHub release.
+
+### Removed
+
+- Automated GitHub release publication, custom release scripts, and the
+  separate development PHAR. Releases now use Laravel Zero's native build
+  command, the `Quality` workflow, and one committed `builds/quickpay` binary.
+
 ## [0.1.0] - 2026-08-09
 
 ### Added

CHANGELOG.md

@@ -87,16 +87,9 @@ git diff --check
 also enforces at least 90% application coverage, validates package metadata,
 and audits the locked dependencies. Coverage requires PCOV or Xdebug.
 
-If packaging behavior changes, also exercise the ignored development artifact:
-
-```bash
-composer build
-builds/quickpay --version
-builds/quickpay list --raw
-```
-
-Generated files beneath `builds/` are never committed. The release workflow
-builds the versioned PHAR from a tagged source commit.
+The versioned `builds/quickpay` PHAR is the only tracked build output because
+Packagist installs it directly. Do not update it in an ordinary contribution;
+maintainers build and commit it in a release pull request.
 
 ## Pull requests
 

CONTRIBUTING.md

@@ -85,16 +85,9 @@ verify` additionally enforces coverage, validates package metadata, and audits
 the locked dependencies. The test suite uses HTTP fakes and does not contact
 Quickpay API.
 
-Build an ignored development PHAR when packaging behavior changes:
-
-```bash
-composer build
-builds/quickpay --version
-builds/quickpay list --raw
-```
-
-The PHAR is a generated release artifact, not repository source. Versioned
-release artifacts are built with `composer release:build -- 1.0.0`.
+The versioned `builds/quickpay` PHAR is tracked so Packagist can install it
+without Laravel Zero's dependency graph. Maintainers build it with Laravel
+Zero's `app:build` command and commit it as described in `RELEASING.md`.
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) before changing commands or security behavior.