Problem

Daily ./script/docker-exec.sh -- bash -lc "./script/release-readiness.sh --json" is red in a clean workspace:

• check-selfhost-spine-coverage-sync fails because vendor/autoload.php is missing
• Attempting composer install inside the docker wrapper fails on PHP 8.2 with lock constraints (ircmaxell/php-cfg + multiple dev locks require PHP ^7)
• north-star5-verify-fast fails with patch-application hint (patches not applied in this flow)

This blocks maintainers from getting a reliable quick readiness signal and therefore blocks a user-facing tag.

Acceptance criteria

• ./script/docker-exec.sh -- bash -lc "./script/release-readiness.sh --json" runs to completion on a fresh checkout.
• spine-coverage gate does not fail due to missing vendor/.
• Patch gates run in the same flow (either apply patches automatically or provide a single documented command sequence).

Repro

./script/docker-exec.sh -- bash -lc "./script/release-readiness.sh --json"
# (currently fails)

./script/docker-exec.sh -- bash -lc "composer install -n --prefer-dist"
# (currently fails on PHP 8.2 vs lock constraints)

Scope

• script/release-readiness.sh — orchestration / vendor bootstrap
• composer.json / composer.lock — PHP version constraints for docker image PHP 8.2
• script/apply-patches.sh — integrate into readiness flow or document prerequisite
• Docker image php-compiler:22.04-dev — ensure composer install succeeds in script/docker-exec.sh

Done when

• ./script/docker-exec.sh -- bash -lc "./script/release-readiness.sh --json" exits 0 on a clean tree after documented bootstrap (composer install + script/apply-patches.sh).
• JSON output includes green spine-coverage and north-star5-verify-fast gates (or documented opt-out with reason).
• README or docs/local-ci-matrix.md lists the single copy-paste release-readiness command sequence.
• No manual vendor/ commit required; lock file installable in Docker PHP 8.2.

Context

Roadmap: #78 (User release roadmap → v1.1.0 → must-ship + gate checklist). Related bootstrap: #1492, #9223.