feat: implement ADDITIONAL_PREPROCESS_CMDS with v4.x compatibility

[ramonskie]

Summary

Implements ADDITIONAL_PREPROCESS_CMDS support, restoring v4.x parity for apps that need to run arbitrary shell commands during the finalize (staging) phase before the web server starts.

Changes

Options Parsing (src/php/options/options.go)

• Parse ADDITIONAL_PREPROCESS_CMDS from .bp-config/options.json as a list of shell commands

Finalize Phase (src/php/finalize/finalize.go)

• Execute each command in sequence during finalize
• Log each command before execution
• Emit security warning when commands are present (arbitrary code execution during staging)
• Fail fast on non-zero exit codes with clear error messages

Integration Tests

• src/php/integration/preprocess_cmds_test.go — validates command execution and output

Fixtures

• fixtures/preprocess_cmds/ — test app with multiple preprocess commands

Documentation

• docs/V4_V5_MIGRATION_GAP_ANALYSIS.md — gap analysis between v4.x and v5.x features

Security Note

ADDITIONAL_PREPROCESS_CMDS allows arbitrary shell execution during staging. A security warning is emitted in the staging log whenever commands are configured.

---

Depends on: #1229 (PHP version placeholders) → #1226 (remove runtime rewrite binary)