Fix: preg_replace_callback() $count by-ref writeback (#19637)

[PurHur]

Summary

• preg_replace_callback() left the optional $count by-ref argument at 0 because BuiltinByRefParams listed preg_replace but not the callback / filter siblings — arg Stdlib: floatval, boolval, gettype(null) and expanded PHPT specs #5 was sent by value.
• Register preg_replace_callback, preg_filter (index 4) and preg_replace_callback_array (index 3) so ZEND_SEND_REF binds the caller slot; writeback via resolveIndirect()->int($count) then matches Zend.
• Extends compliance .phpt + BuiltinByRefParamsTest for the regression.

php-src: ext/pcre/php_pcre.c — $count out-parameter.

Test plan

• Issue repro (Zend + VM + JIT) via ./script/docker-exec.sh
• ./script/phpunit.sh --filter 'preg_replace_callback_limit_count|testPregReplaceFamilyCountByRef'
• php script/bootstrap-inventory.php --check → OK 5179/5179

Verification transcript

$ ./script/docker-exec.sh -- bash -lc 'php -r '\''$c=0; $r=preg_replace_callback("/a/", fn($m)=>"A", "aa", -1, $c); echo "$r|$c\n";'\''; php bin/vm.php -r '\''...'\'' ; php bin/jit.php -r '\''...'\'''
AA|2
AA|2
AA|2

$ ./script/phpunit.sh --filter 'preg_replace_callback_limit_count|testPregReplaceFamilyCountByRef'
OK (3 tests, 9 assertions)

Closes #19637

Made with Cursor