Composer 2.8: patch-only updates and a better audit surface

Composer 2.8 continued the recent trend of making dependency management more operationally deliberate instead of purely mechanical.

The notable additions are `--patch-only` for safer updates, new audit severity controls, better post-update bumping, a lock-file JSON schema, stricter autoload ambiguity checks, and better diagnostics around platform requirements and deleted vendor files.

That combination makes 2.8 valuable to teams that want to move dependencies more often without turning every update into a gamble.