Add PHPUnit setup and run tests in CI

[HafizMMoaz]

Part of zerp-pk/zerp#48, which tracks every published module shipping zero automated tests and no CI to run them.

CI here existed but only ran composer validate and php -l. Nothing executed a test, because there were none.

What's added

The scaffolding package-template already carries and the modules never received:

• orchestra/testbench in require-dev, autoload-dev for the test namespace, scripts.test
• an explicit "php": "^8.2" in require, which was previously an empty object
• phpunit.xml and a testbench TestCase registering the module's service provider
• a Run tests step in the workflow, and tests added to the lint path
• .gitignore, so vendor/ and the phpunit cache stay out of the repo

What the tests actually check

PackageIntegrityTest targets the wiring that fails silently rather than loudly. None of it needs a database or the host app, so it runs on a bare checkout in CI:

Test	Regression it catches
declared providers exist and boot	a renamed or moved provider quietly stops Laravel auto-discovery; the module stays installed but never boots, with nothing logged
module.json parses and has the fields PackageSeeder reads	a malformed manifest breaks the scan that writes add_ons rows
module.json package_name matches the composer package	the module registers in add_ons under a key nothing can enable
every class in src/ sits at its PSR-4 path	the class is unreachable at runtime, on whichever request first touches it
migration filenames unique and well formed	loadMigrationsFrom() keys by filename, so a duplicate means one migration never runs
every migration returns a Migration	otherwise it throws during someone's deploy, not before

PSR-4 is verified by reading each file's declared namespace rather than by autoloading it. Module classes extend host app classes (App\Http\Controllers\Controller, App\Models\User, App\Models\Concerns\TenantScoped) that do not exist outside an install, so class_exists() would fatal on the missing parent instead of reporting the mapping. Worth noting as its own problem: these packages have hard, undeclared dependencies on host app classes.

Verification

Run locally against all 32 module packages before opening these PRs. All 32 green, ~1,600 assertions total. composer validate --strict is clean on all 32.