feat: audit NT009 official workbooks in isolated PHP tooling (#95)

[vitormattos]

SUPERSEDED — no merge. The base branch of this intermediate signed PHP audit became incompatible after #97 evolved. Its implementation was re-created as signed incremental commits in #99, based on the final #97 head, without squashing or force-rewriting commit history.

---

Intent

Supersede the Python-only proof-of-source PR #96 with a PHP/PhpSpreadsheet audit, without claiming that NT009 is already effective for production issuance.

Implementation

• Download exact Anexo VI v1.04.01 and Anexo VII v1.03.00 through the official www.gov.br/nfse source URLs declared in the manifest, or accept locally downloaded files.
• Validate SHA-256 against independently recorded October 2026 observations and examine sheet names.
• Preserve a JSON report of original Annex VI layout rows for important fields rather than inferring mandatory conditions from appearance.
• Compare all Annex VII indicator code/description/location triplets with the current Anexo C v1.01 snapshot; record additions, removals and description changes.
• Offline PHPUnit fixtures cover the diff algorithm; an advisory GitHub Actions job attempts the exact public-download audit and stores its evidence artifact.

Review gates and exclusions

• This PR is stacked on refactor: replace Python domain utilities with isolated PHP tooling #97. Review and merge the PHP migration first.
• No new tax code, schema version, XML layout, runtime catalog switching or consumer Composer revision is activated in this PR.
• The public source files and applicable XSD/effective dates still need independent verification for full issue Implement version-aware NT009 v1.01 DPS/IBSCBS contract #95 completion.
• No issue closure or merge is requested.