Web: header() Location redirect (302) for VM, JIT, and AOT

[PurHur]

Problem

header('Content-Type: …') works in VM/JIT/AOT, but redirect responses (header('Location: /path') + optional http_response_code(302)) are untested and may not emit CGI-correct Status: / Location: ordering.

#68 tracks a PHPT suite; this issue ships the builtin behavior redirect apps need (post-login, trailing-slash canonicalization).

Goal

header('Location: /done');
http_response_code(302);
// or: header('Location: /done', true, 302);

VM + JIT + AOT output includes Status: 302 (or 302 Found) and Location: /done before body (empty body acceptable).

Implementation hints

Layer	Files	Notes
VM	ext/standard/header.php, lib/Web/ response buffer	Replace prior headers on redirect; default 302 when Location set
JIT	ext/standard/JitHeader.php	Mirror VM CGI line format
AOT	same as JIT	Per-request header list reset (#49)
Tests	test/compliance/cases/web/header_redirect_302.phpt	VM in ci-fast
Tests	test/real/cases/web_redirect_302.phpt	tracks #68

Acceptance criteria

./script/ci-fast.sh --filter 'header_redirect|web_redirect'
docker run --rm -v "$(pwd):/compiler" -w /compiler php-compiler:22.04-dev \
  ./script/ci-local.sh --filter header_redirect

Dependencies

• Stdlib: http_response_code() for 404/500 and API status #252 / http_response_code (likely ✅)
• Web: Runtime-populated superglobals for JIT and AOT (per-request $_GET/$_POST) #49 runtime superglobals (redirect targets with query strings)
• Testing: Expand web PHPT suite (redirects, empty input, POST merge) #68 — additional PHPT matrix (do not duplicate all cases here)

Verification

Local/Docker only.

Links

• lib/Web/Superglobals.php, ext/standard/header.php
• ROADMAP 🗺️ ROADMAP: Self-host + web-capable PHP subset (living) #78 Phase 2 stdlib / Phase 1 web-runtime