on.push had no branch filter, so every job ran on both push and pull_request: a
push to a branch with an open PR built the whole pipeline twice. Restrict push to
main and v* tags (feature branches are covered by their pull_request run) and add a
concurrency group that cancels superseded in-flight runs.

Byte-by-byte layout of every ZSL index file (.cfs, .fnm, .fdt/.fdx, .tis/.tii,
.frq/.prx, .nrm, .del, segments.gen/segments_N) with ASCII field diagrams, the
modified-UTF-8 / SmallFloat / VInt quirks, and worked hex examples. Derived from the
parsers in sdsearch-core/src/zsl. Linked from ARCHITECTURE.md and the README.

Add sdsearch.stub.php: signatures + PHPDoc for the whole extension surface
(sdsearch_version, SdSearch\Engine, SdSearch\Writer) for IDEs/PHPStan; never loaded at
runtime. Add docs/API.md: narrative guide with end-to-end indexing/update/search
examples, the params + hit JSON contracts, and the field kinds. Symbol names verified by
Reflection against the compiled extension; stub passes 'php -n -l'. Linked from README.

On a v* tag, build + smoke-test three PHP 8.4 NTS binaries in parallel and publish
them to a GitHub Release:
  - sdsearch-windows-x64-php84nts.dll   (windows-latest, nightly + LLVM)
  - sdsearch-ubuntu-x64-php84nts.so     (ubuntu-latest, glibc ~2.39)
  - sdsearch-el8-x64-php84nts.so        (rockylinux:8 container, glibc 2.28)

The EL8 build (Rocky 8 + Remi PHP 8.4 NTS) links only up to GLIBC_2.28, so it loads on
RHEL/CentOS/Rocky/Alma 8 & 9 (verified locally in a rockylinux:8 container). ext-php-rs
needs PHP/PHP_CONFIG set explicitly in the container. The publish job asserts the tag
equals sdsearch-core's crate version, then attaches the binaries. workflow_dispatch runs
a build-only dry run (no release). github.ref_name is passed via env and quoted.