Release v1.1.1: automatic publishing and full live SDK contract

[roncodes]

Summary

• trigger release validation and publication automatically when a semantic release/ branch is merged into main
• derive the version from the merged branch and reject ordinary main pushes
• run all 220 locked Fleetbase and Core API Postman requests through their exact PHP SDK methods against a disposable Fleetbase stack
• boot that stack with the same published image, clean database, non-interactive installer configuration, and Fleetbase-owned seed-and-mint action used by the Core API and Fleet-Ops contract workflows
• retain direct SDK success and failure smoke cases against that same instance
• normalize order dispatch aliases so dispatch, positional dispatchOrder, the legacy parameter-array form, and active-record dispatch use the official PATCH endpoint
• generate a stable-ID PHP example catalog for the coordinated fleetbase.io API documentation update
• avoid duplicate CI/security executions by validating release branches through their pull request only

Disposable contract architecture

Fleetbase's reusable api-contract.yml owns an entire isolated job, so it cannot directly host a caller-started PHP bridge. This workflow therefore uses its canonical bootstrap and shared composite action on the SDK runner, then points the Postman collection base URL through the SDK bridge. That preserves the established Fleetbase fixtures while proving requests exercised the library rather than only the API.

The final run used fleetbase/fleetbase-api@sha256:005e7da6e367ccd2e8242747c9cb09371bd193932c42d3c359692125e7a1cd67 and the locked Postman merge commit 9a7d4d898b4e74d735d93c78d67d4d5013c1a28b.

Release behavior

Version 1.1.0 has already been published and its tag remains immutable. Merging this pull request starts the release workflow from the resulting main commit. The workflow verifies that the commit is associated with a merged release-prefixed pull request, derives version 1.1.1, reruns the live SDK contract and all release gates, then publishes through the protected release environment. There is no manual workflow-dispatch input.

Verification

• composer check: 34 PHPUnit tests, 2,315 assertions, 220 mapped requests, clean generated artifacts, AGPL checks, and API compatibility with 1.0.2 and 1.0.3
• CI run 33724740273: PHP 7.4-8.5 lowest/latest matrix, exact 100% line/branch coverage, mutation threshold, consumer fixtures, archive inspection, and release-candidate build passed
• security run 33724740260: Composer audit/license metadata, dependency review, secret scan, and Actions CodeQL passed
• disposable contract run 33724740258: canonical stack boot, shared fixture mint, both official Postman collections, direct SDK smoke, and teardown passed
• downloaded live artifact independently verified: 220/220 requests invoked and no locked request bypassed its PHP SDK method

Supersedes #7 after the published 1.1.0 tag required the release branch to move to 1.1.1.

Coordinated API reference PR: fleetbase/fleetbase.io#95