[MudassarTariq]

Stalled responses could exceed the configured timeout, truncated responses could be accepted as complete, and diagnostics could expose API keys. This change enforces the transport limits and prepares patch release 3.0.2.

• Use cURL with a bounded response sink, enforce connection/read limits, reject incomplete responses, and limit decoded response bodies, including gzip.
• Validate HTTP headers and user-agent values before any transport runs. Redact API keys from configuration debug output and transport diagnostics, and close response streams after use.
• Report timeouts without guessing which request phase failed or reporting an incorrect duration.
• Add HTTP/TLS regression coverage and CI for PHP 8.1–8.5, including the lowest allowed dependencies on PHP 8.1. Audit dependencies, check supported runtime patch levels, pin workflow actions, and limit the workflow token to read access.

Public methods, response models and JSON/XML support are preserved. Custom Guzzle exception subclasses with incompatible constructors are normalized to the corresponding base exception; nested diagnostic causes are redacted copies. PHP engine updates remain the application host's responsibility. PHP 8.1 coverage verifies compatibility, not runtime security support.

Validation:

• 57 tests / 148 assertions pass locally, including real local HTTP/TLS tests for stalled responses, truncation, redirects, decoded-size limits, certificate trust and hostname rejection.
• The timeout-message regression produced four failures before the correction and passes afterwards.
• Composer strict validation, dependency audit, PHP syntax and formatting checks pass.
• A real HTTPS request with an intentionally invalid key verifies HTTP 401 mapping. Version and user-agent both report 3.0.2.
• A clean package install without development dependencies passes platform checks and verifies autoloading, version, user-agent and client construction.
• GitHub CI for this revision: all six jobs pass, each with 57 tests / 148 assertions and a clean dependency audit.

After the required review, merge this PR and publish v3.0.2. No production hosting change is needed for deployments that do not run PHP.