PR Summary

Low Risk
CI-only shared workflows with additive optional inputs and registry cache default unchanged for existing callers; no runtime or deploy behavior until separate repo migrations.

Overview
Phase 1A (DEVEX-1630) adds shared reusable PHP build orchestrators in encodium/.github so service repos can replace duplicated Build.yaml spines later. No service repos are changed in this PR; workflows only take effect once a caller references them.

New orchestrators — build-php-v1.yaml runs calculate-tag → matrix build via php-build-push.yaml → tag-and-release and exposes a tag output; callers pass a JSON images array for app/nginx/profiler/apache tagging. build-php-laravel.yaml uses the same spine but delegates build to php-laravel-build-push.yaml (app + webserver, optional CLI).

php-build-push.yaml gains optional image_name, extra_tag, and cache_type; a meta step resolves GHCR names (including bare profiler names like rp_api-profiler), companion tags, and per-image/per-dockerfile GHA or registry cache scopes so matrix legs do not share one cache. Docker actions are bumped (buildx/login v3, build-push v6).

php-laravel-build-push.yaml adds configurable webserver_tag_prefix (default webserver-) instead of hardcoded webserver- tags.

Design and rollout docs are added under docs/superpowers/.

^{Reviewed by Cursor Bugbot for commit 42a605b. Bugbot is set up for automated code reviews on this repo. Configure here.}

Thanks Bugbot — both valid, fixed in 42a605b (php-build-push.yaml resolve step):

1. Profiler image missing org prefix (High): a bare image_name (e.g. rp_api-profiler) is now scoped under the repo owner → ghcr.io/encodium/rp_api-profiler. A value that already contains owner/ and the empty default (github.repository) are unchanged. Tags are built from the corrected ref.
2. Matrix legs share build cache (Medium): the cache key/scope now incorporates the dockerfile + build target, so same-image legs (app/nginx/apache under <owner>/<repo>) get distinct caches (:buildcache-build-nginx-Dockerfile, gha scope=<owner>-<repo>-build-nginx-Dockerfile, etc.) instead of colliding.