Fix CI shell safety, widen Symfony constraints, add Behat 4 step attributes

- lock-symfony-version.sh: replace cat<<<$(jq) with tmp+mv to avoid
  file truncation; add .key as $k capture in with_entries per jq safety rules
- lock-behat-version.sh: new script mirroring lock-symfony-version.sh,
  fixes the Behat 4 lock step which was wrongly targeting require-dev
  instead of require
- CI: actions/checkout@v3 → @v4; composer validate --strict; use
  lock-behat-version.sh in the Behat 4 step
- composer.json: widen symfony/config, symfony/browser-kit,
  symfony/http-client to ^7.4 || ^8.0 so Symfony 8 installs without CI overrides
- MinkContext: add #[\Behat\Step\Given/When/Then] attributes alongside
  existing docblocks so Behat 4 (which ignores docblock annotations)
  can discover all step definitions

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

composer.json

@@ -24,13 +24,13 @@
         "php": "^8.3",
         "behat/behat": "^3.31",
         "behat/mink": "^1.5",
-        "symfony/config": "^7.4"
+        "symfony/config": "^7.4 || ^8.0"
     },
     "require-dev": {
         "behat/mink-browserkit-driver": "^2.0",
         "phpspec/phpspec": "^8.0",
-        "symfony/browser-kit": "^7.4",
-        "symfony/http-client": "^7.4"
+        "symfony/browser-kit": "^7.4 || ^8.0",
+        "symfony/http-client": "^7.4 || ^8.0"
     },
     "replace": {
         "behat/mink-extension": "self.version"