Make every documented Laravel client interface role-safe

[rmcdaniel]

Problem

On main at b6c427ed3e40b921921461cde3ac14e85f644831, the Laravel bridge defers application-credential resolution for LaravelWorkflowClientInterface, but the separately documented WorkflowClientInterface remains an alias of the eager concrete Client. A Laravel command, controller, listener, job, or service that constructor-injects that lower-level interface can therefore abort an unrelated worker-only Artisan process during container resolution when only a worker credential is present, even though no application-client operation is performed.

Acceptance criteria

• Container resolution and constructor injection of both LaravelWorkflowClientInterface and WorkflowClientInterface are credential-lazy.
• The first real application-client operation without a client credential fails clearly before transport.
• WorkerFactory and durable-workflow:worker resolve only worker credentials and remain operational when application services inject either or both documented interfaces.
• The concrete Client may remain an explicit eager low-level surface, but public Laravel guidance distinguishes it from the normal role-safe interface path.
• Laravel fakes replace both interfaces coherently without constructing a network client.
• Clean-application and config-cache compatibility regressions cover worker-only bootstrap with both interfaces, client-only operations, and the supported Laravel/PHP matrix.
• A published successor passes the Laravel/Symfony by standalone Server/managed Cloud framework qualification and the application-shaped Sample App service-mode smoke.

Delete when

Delete when a publicly installable PHP SDK release proves worker-only Laravel startup with services injecting both documented interfaces, while the first unauthorized application-client operation still fails before transport.