fix(LINCHPIN-5617): Drop the deprecated CallTimePassByReference sniff from Linchpin-Minimum

[aaronware]

ClickUp: LINCHPIN-5617

Problem

Linchpin-Minimum referenced Generic.Functions.CallTimePassByReference, which PHPCS deprecated in 3.12.1 and removes in 4.0.0. Referencing a deprecated sniff makes PHPCS print a banner to stdout, ahead of the report payload:

WARNING: The Linchpin-Minimum standard uses 1 deprecated sniff
...
{"totals":{...}}

Actions::phpcs_report() redirects stderr (2>/dev/null), which doesn't help — the banner is on stdout. json_decode() returns null and run() fails closed with:

PHPCS produced no parseable report.

…exiting 1 on every run, violations or not. That breaks the check-staged-cs pre-commit hook and the check-branch-cs step in php-checks.yml for every repo on Linchpin-Minimum. Consumers have been working around it with a local <exclude>; those can come out once this ships.

The full Linchpin ruleset has excluded this sniff for a while — Linchpin-Minimum never got the same treatment.

Fix

Drop the rule reference. Nothing is lost: call-time pass-by-reference has been a fatal error since PHP 5.4, and this package requires PHP 8.0+. A comment is left in its place so it doesn't get re-added.

Verification

Before:

$ ./vendor/bin/phpcs --standard=Linchpin-Minimum --report=json sample.php 2>/dev/null
WARNING: The Linchpin-Minimum standard uses 1 deprecated sniff
...
{"totals":...}          # json_decode() -> null

After — JSON and nothing else, json_decode() returns an array with files:

$ ./vendor/bin/phpcs --standard=Linchpin-Minimum --report=json sample.php 2>/dev/null
{"totals":{...},"files":{...}}

Also ran the CI checks locally against the changed file: xmllint --schema vendor/squizlabs/php_codesniffer/phpcs.xsd validates, and the XML code-style diff (with XMLLINT_INDENT set to a tab, as CI sets it) is clean for both rulesets.

Not fixed here

Two things surfaced while verifying this, both pre-existing on main and both filed separately rather than bundled in:

• Linchpin-Minimum sets no testVersion, so PHPCompatibility 2.1.8 aborts checking of every file on PHP 8.4+ — the standard then reports only an Internal.Exception on line 1 and silently misses real findings (eval( $_GET[...] ) included). Linchpin/ruleset.xml sets testVersion 8.2-8.4; Minimum does not. This is the more serious half of the same broken gate.
• php-parallel-lint/php-parallel-lint and php-console-highlighter are required in composer.json but are in neither packages nor packages-dev in composer.lock. composer validate --no-check-all --strict flags this locally (Composer 2.10.3); CI's Composer does not, so this job is green despite it.

🤖 Generated with Claude Code

[aaronware]

Task linked: LINCHPIN-5617 Linchpin-Minimum references a sniff PHPCS deprecated in 3.12.1, breaking check-branch-cs everywhere