Add composer plugin to enforce pub/* worker shims (issue #1 part 2)

[acourtiol]

Closes the second half of #1 — preventing magento/magento2-base from overriding pub/index.php on patch-day installs.

Problem

magento/magento-composer-installer hardcodes magento/magento2-base at the highest deploy priority (DeployManager::$highPriority = 10 + maxPriority — source). On a fresh install our package's extra.map runs AFTER magento2-base, so the worker shims win.

But on composer update magento/magento2-base alone — typical for the quarterly Magento patch cycle — our package isn't touched, its extra.map never runs again, and stock Magento pub/index.php etc. silently come back. Worker mode breaks until someone notices and reinstalls our package.

Solution

Convert this package from type=magento2-component to type=composer-plugin, and add a small EnforcePubFilesPlugin that:

1. Subscribes to POST_PACKAGE_INSTALL and POST_PACKAGE_UPDATE for any package, priority -1000 so we run AFTER magento-composer-installer's own deploy step on the same event.
2. After each operation, compares each pub/*.php in the project root against the same file under vendor/opengento/magento2-frankenphp-base/pub/ via md5_file().
3. Copies any mismatch back from vendor → project pub/. Idempotent and cheap (skips when hashes match).

This makes the worker shims durable across every kind of composer operation including the patch-day update of magento2-base.

Trade-offs of changing to type=composer-plugin

• magento/magento-composer-installer no longer processes our extra.map (it filters on type ∈ {magento2-module, theme, library, language, component}). So I've dropped extra.map and let the plugin handle file copying directly on POST_PACKAGE_INSTALL of our own package (initial-install path) AND on POST_PACKAGE_UPDATE of anything else (re-assert path).
• Composer 2.x prompts users to allow the plugin in their config.allow-plugins on first install. Same UX as any other composer plugin (e.g., magento/composer-root-update-plugin itself).

Alternative considered — split into two packages

A separate opengento/magento2-frankenphp-base-installer (type=composer-plugin) that opengento/magento2-frankenphp-base (type=magento2-component) requires. Cleaner separation of concerns but creates a new package to maintain. Happy to refactor to that shape if you prefer — it's mostly a file-shuffle exercise.

Stacking

• Independent of Fix worker loop to honor MAX_REQUESTS #4 (worker loop fix) and Don't tear down the worker on per-request exceptions #5 (worker error handling).
• Touches composer.json like Add pub/get.php worker shim (issues #2, #3) #6 (get.php worker shim) does — if both merge, rebase whichever lands second.