[TungYenTsai]

Dependabot #27 upgrades module-yii2 to a version requiring PHP 8.3, and #28 upgrades qr-code to a version requiring PHP 8.4. Both fail installation on the project's PHP 8.2 platform before tests or audit can run.

This change resolves dependencies against the declared minimum PHP 8.2.0, temporarily excludes Yii2 module major updates and QR versions >=6.1 from Dependabot proposals, and checks the real PHP/extensions after installation in both CI jobs. Release guidance records when to revisit these exclusions. Security audits remain enabled.

No package versions, source references, URLs or other package metadata change. composer.lock changes only its content hash and platform override. This PR is independent of P16 #29 and does not upgrade PHP or modify the application.

Validation:

• Composer lock refresh: nothing to modify in package versions; no advisories found.
• Full packages and packages-dev metadata match main exactly.
• Real platform check passes on PHP 8.2.35; both YAML files parse; git diff whitespace check passes.
• Dry-run qr-code 6.1.3 update is rejected because PHP ^8.4 is incompatible with the configured PHP 8.2.0 target.
• composer validate --strict reports the same six existing version-constraint warnings as main, with no new warnings.
• PR CI passes: unit 1229 tests / 6786 assertions; functional 198 tests / 801 assertions; both real-platform checks, license inventory and audit pass. No security vulnerability advisories found.
• No dev6 environment, vendor or system packages changed. Incompatible update proposals Bump codeception/module-yii2 from 1.1.12 to 2.0.5 #27 and Bump endroid/qr-code from 6.0.9 to 6.1.3 #28 are closed; their branches are retained.

The policy applies to main after this PR is merged. Higher-PHP upgrades remain separate work requiring environment and application verification.