[NhanAZ]

Summary

• Make Composer preparation recognize DevTools' existing self-packaging configuration, so it does not try to import PHP Parser as a virion.
• Keep the generated BedrockNexus workflow intact and allow the repository checks to accept its full SHA action pins while still requiring checkout credentials to be disabled.
• Add a regression test that prepares and builds a DevTools PHAR with the PHP Parser files included.

This keeps Composer virion validation unchanged for other projects and lets the BedrockNexus workflow build DevTools itself.

Local composer check passed with 543 tests, 12,926 assertions, PHPStan and PHAR validation.