Enable larastan checkOctaneCompatibility

[jakobkollerup]

Sets checkOctaneCompatibility: true in extension.neon and
extension-strict.neon, enabling larastan's OctaneCompatibilityRule
company-wide. Most of our services run Octane; larastan defaults this rule
to false and we never overrode it.

What it catches

Container misuse inside service provider bindings — the container passed
into a constructor within a singleton() closure, or $this->app reached
from a param-less bind()/singleton() closure. bind() with an explicit
$app param is exempt, and it does not detect broader Octane state leaks
such as static caches on long-lived singletons.

Blast radius: zero

I probed every spilnu/services repo before opening this — phpstan with the
rule enabled, run in each repo's CI php image, filtered to identifier
larastan.octaneCompatibility:

37 of 37 repos clean. 0 findings.

Not vacuous: 20 bind()/singleton() call sites across the fleet were
analysed and cleared. They pass because they either use static function
closures (which cannot bind $this) or take the container explicitly.

So no baseline regeneration is needed anywhere, and no currently-passing
phpstan job starts failing. Verified end-to-end too: with the rule forced on
against a real generated phpstan.neon, it fires on the expected lines and
adds no other errors.

Note

Needs a new tag before Renovate picks it up — merging alone propagates
nothing.