lint (php) fails: phpstan/phpstan-phpunit 2.0.19 conflicts with the phpstan/phpstan 2.2.3 pin

Since 2026-09-26, lint (php) fails on every MR that changes PHP files. Composer cannot install the dev dependencies, so PHPCS and PHPStan never run.

• phpstan/phpstan-phpunit 2.0.19 (released 2026-09-26) requires phpstan/phpstan ^2.2.6.
• Canvas pins phpstan/phpstan to 2.2.3 in require-dev.

Example: !1712 (merged) (job log).

Proposed resolution: raise the phpstan/phpstan pin to 2.2.6 or later, and fix or baseline any new findings.