CI pipeline to build the PHAR

[asgrim]

Design documentation: https://github.com/ThePHPF/pie-design/blob/main/README.md

Implement a CI pipeline that builds an artifact pie.phar which can be installed by consumers. The built PHAR artifact should be automatically attached to releases, when they are made.

[asgrim]

Example release pipeline from @norberttech - https://github.com/flow-php/flow/blob/1.x/.github/workflows/build-release.yml

And some useful info from Box maintainer @theofidry;

I didn't really try to do a magical GitHub actions for it tbh, because there is a bit too many things to consider, and mostly I think it you go down that route then you just never test your PHAR which I feel is wrong. It would be akin to publishing a docker image without testing it (which arguably a fair number of people do).

I think it's great if you can manage to get some integration/e2e tests where you can swap the binary used (e.g. to just use the "in-memory" app, a PHAR or docker). But I understand it may not be your priority.

That said the steps are not too complicated, to complement @norberttech:

• install deps as usual, mind that it's a good practice to configure the PHP platform with Composer
• build the PHAR (box compile, dunno if you have extra steps to do or not)
• I recommend at least a minimal smoke test:

            # Smoke test
            -   name: Ensure the PHAR works
                run: bin/box.phar --ansi --version

Then to sign + publish:

            -   name: Import GPG key
                if: github.event_name == 'release'
                uses: crazy-max/ghaction-import-gpg@v6
                with:
                    gpg_private_key: ${{ secrets.GPG_KEY_41539BBD4020945DB378F98B2DF45277AEF09A2F }}
                    passphrase: ${{ secrets.GPG_KEY_41539BBD4020945DB378F98B2DF45277AEF09A2F_PASSPHRASE }}

            -   name: Sign the PHAR
                if: github.event_name == 'release'
                run: |
                    gpg --local-user theo.fidry+box@gmail.com \
                        --batch \
                        --yes \
                        --passphrase="${{ secrets.GPG_KEY_41539BBD4020945DB378F98B2DF45277AEF09A2F_PASSPHRASE }}" \
                        --detach-sign \
                        --output bin/box.phar.asc \
                        bin/box.phar

            -   uses: actions/upload-artifact@v4
                name: Upload the PHAR artifact
                with:
                    name: box-phar
                    path: |
                        bin/box.phar
                        bin/box.phar.asc