P2-A: move ${{ inputs.line_limit_paths }} from raw shell into env: block (PATHS)
to eliminate template-injection surface on caller-controlled input.
P2-B: replace 'npm run lint --if-present' (always exits 0 on missing script,
killing the node --check fallback) with explicit node -e detection;
fallback now actually runs when no lint npm script is defined.
P2-C: both phpcbf and phpcs steps now detect which of phpcs.xml /
phpcs.xml.dist / .phpcs.xml.dist is present and pass it to --standard;
guard and command now agree for all three config filename variants.
Validators: actionlint 1.7.4 clean, yamllint 1.38.0 clean (both files).
Version: 1.6.1
Agent-Session: claude/reusable-ci-20260616-p2-fixes
6adf255dea