Bring in Packager and make console commands extendable

[LukeTowers]

Companion to wintercms/winter#1259 (UpdateManager refactor). That refactor drives module/plugin/theme install and update operations through Composer instead of the legacy marketplace zip downloads, and streams console command output to the backend UI. This PR adds the Storm-side primitives required for that work:

• Bring in winter/packager (^0.4.3) and add a Winter\Storm\Packager\Composer helper that proxies to a shared Winter\Packager\Composer instance bound to base_path(), plus higher-level helpers used by the new UpdateManager (getWinterPackages(), getAvailableUpdates(), getPackageInfoByExtension(), getWinterPackagesWithVersion(), etc.) for identifying Winter packages and their available updates from Composer metadata (vendor/composer/installed.json).
• Add the Winter\Storm\Foundation\Extension\WinterExtension interface — a common contract (path / version / identifier / composer package info) for everything installable on top of Winter (modules, plugins, themes) so the UpdateManager and the extension managers in winter#1259 can treat them uniformly. ModuleServiceProvider implements it here via the new HasComposerPackage trait; the plugin & theme implementations live in winter#1259.
• Make console commands extendable — Winter\Storm\Console\Command now uses ExtendableTrait + Emitter, and overrides run() to fire a command.beforeRun event once output is initialized. This allows external code (e.g. the web-based updater) to intercept a command's output/lifecycle, such as streaming winter:update output to the browser. The override replicates Laravel 9's Illuminate\Console\Command::run() and invokes the grandparent Symfony\Component\Console\Command::run() directly, with a scoped Termwind renderer swap so nested/captured command output renders to the correct output stream.

Merge considerations:

• The allow-plugins.php-http/discovery: false config entry is needed because winter/packager currently depends on php-http/discovery (which satisfies its psr/http-client-implementation requirement at resolution time). Downstream projects will face the Composer plugin allow-prompt on update unless packager drops this dependency first (see review discussion).
• winter/packager should receive a stable v1.0 release when this is merged.
• winter/packager also brings composer/composer into the production dependency tree of every Winter install.

[github-actions]

This pull request will be closed and archived in 3 days, as there has been no activity in the last 60 days.
If this is still being worked on, please respond and we will re-open this pull request.
If this pull request is critical to your business, consider joining the Premium Support Program where a Service Level Agreement is offered.

[github-actions]

This pull request will be closed and archived in 3 days, as there has been no activity in the last 60 days.
If this is still being worked on, please respond and we will re-open this pull request.
If this pull request is critical to your business, consider joining the Premium Support Program where a Service Level Agreement is offered.

[github-actions]

This pull request will be closed and archived in 3 days, as there has been no activity in the last 60 days.
If this is still being worked on, please respond and we will re-open this pull request.
If this pull request is critical to your business, consider joining the Premium Support Program where a Service Level Agreement is offered.

[github-actions]

This pull request will be closed and archived in 3 days, as there has been no activity in the last 60 days.
If this is still being worked on, please respond and we will re-open this pull request.
If this pull request is critical to your business, consider joining the Premium Support Program where a Service Level Agreement is offered.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fcd89eb7-aa35-42af-a092-839efac71eb9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wip/support-uploading-packages-update-manager-changes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}