fix(tests): pass smoke checks after create-project

[rodrigoteamx]

A fresh composer create-project in v0.52.0 failed two PHPUnit tests: the stamp test rejected the birth record Composer had just written, and the secret-ignore test required a .git directory that the generated app does not have. The stamp fixtures also used a cleanup glob that traversed ..; a controlled reproduction confirmed it could delete a neighboring temporary file.

The suite now validates either framework-stamp state, checks the shipped ignore rules in a disposable Git repository, and cleans fixtures without following symlinks or leaving their directory. A regression test protects neighboring files and symlink targets. CI creates a house from the current tree before installing opt-ins, verifies its birth record and absence of .git, and treats PHPUnit warnings as failures. The README introduces house:start, --dry-run, and --sign and identifies the welcome page's design-asset routes.

Validation on PHP 8.3.33 / Composer 2.10.2:

• Reproduced both original failures in a stamped copy without .git.
• Checkout suite: 178 tests, 400 assertions, 66 opt-in skips; no failures or warnings.
• Executed the new CI create-project step locally: 178 tests, 428 assertions, 66 opt-in skips; no failures or warnings.
• PHPStan, full code-style dry run, boot-proof, Composer validation, attribution, and diff whitespace checks passed.