[shadetheory]

Summary

Add shipmonk/composer-dependency-analyser as a dev dependency and run it in the test workflow, in its own step immediately after composer validate.

The test matrix rewrites composer.json to pin Laravel and Testbench for that job. The published composer.json is restored before validation, so the analyser checks this package's own requirements. --no-check-lock is set because the lock file belongs to the matrix install, and this repository does not commit a lock file.

composer-dependency-analyser.php ignores one false positive: orchestra/testbench installs laravel/framework, and that package replaces illuminate/*. The analyser then attributes those classes to laravel/framework and reports the Illuminate requirements as unused. The config ignores that shadow report and the unused report for the Illuminate packages this package requires. It does not ignore anything else.

The config file is export-ignore, like the other development config.

This branch includes the dependency declaration changes from the other pull request.

Test plan

• vendor/bin/composer-dependency-analyser reports no issues
• composer validate --strict --no-check-lock
• vendor/bin/pest
• The test workflow's "Analyse composer dependencies" step passes