V3 PHP Composer toolchain capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local composer CLI ingredient exposes bounded project operations for readiness, composer.json validation, test script execution, and dependency policy audit. Project operations run from an explicit project directory cwd supplied at execution time, use non-interactive/no-ANSI output, avoid caller-supplied Composer flags, avoid shell wrappers, and keep diagnostics visible as text or JSON output. Test execution is approval-gated because Composer scripts execute project-defined code. Dependency audit is approval-gated because Composer checks installed packages against Packagist or configured repository advisory data. Requires composer on PATH.