fix: close the variables namespace inside a context too

[refsz]

The second half of #40. Its squash captured only the first commit - the two below were pushed to that branch moments too late, so main has the top-level fix without the context-level one. Cherry-picked onto current main, unchanged; nothing to do on #40.

The same hole one level down

#40 tightened the top-level variables and left contexts.*.variables as Expect::anyOf(array, null). So constatns: under a context was still valid config, and the override silently never applied. Verified against the binary:

before   value=[NULL]
         > printf %s token          <- empty argument
         Done (exit 0)

after    Unexpected item 'contexts > local > variables > constatns', did you mean 'constants'?

Same argument for doing it before 0.2 as in #40: tightening later rejects configs that load today, which turns a fix into a breaking change.

The context body stays open on purpose. A listener may read a key of its own out of the raw config, and nothing in Sputnik reads a context beyond description and variables.constants - I checked every read before closing anything. Only the variables namespace is closed, and a test pins that distinction so it does not get closed by accident later:

public function testContextKeysOutsideVariablesStayOpenForListeners(): void

A second silent no-op, named in its own comment

Reading resolve() for this turned up the guard for context-level secrets, whose docblock says secrets are not context-overridable "matching dynamics" - but dynamics had no guard. So a contexts.*.variables.dynamics block was ignored without a word, exactly the failure mode that comment exists to prevent one key over.

Both sections now raise the same explanatory error:

Context 'local' declares a 'variables.dynamics' block, but only constants are context-overridable

That is also why the schema still accepts those two keys rather than rejecting them outright: a generic unexpected-item message would be worse than the reason the resolver can give.

The guard is assertOnlyConstantsAreContextOverridden() now, since assertNoContextLevelSecrets had stopped describing what it checks.

Docs

contexts.md states the rule where a reader configures an override, instead of leaving it to be discovered as a runtime error, and secrets.md notes that the same validation applies one level down.

Verified

vendor/bin/phpunit                        753 tests, 1282 assertions, OK (3 new)
vendor/bin/phpstan analyse                [OK] No errors
vendor/bin/php-cs-fixer fix --dry-run     0 of 153 files
mkdocs build --strict                     clean

🤖 Generated with Claude Code

https://claude.ai/code/session_018CTvnzcNYmFgm2HQcm821A