[php-src] PR #23881: Extend map_ptr on CE cache hit like other SHM paths

Pull Request: https://github.com/php/php-src/pull/23881 Author: samvallad33 Fixes GH-23637 FPM workers were SEGV'ing in the fcall observer with a nonsense address that looked like heap corruption. The crash site was the observer. The gap was earlier. When a worker hits the CE cache fast path in zend_lookup_class_ex, it can return an immutable SHM class whose method run_time_cache offsets were allocated by another worker after this one last synced CG map_ptr_last. Script load, inheritance cache, persist, and PFA already call zend_map_ptr_extend in that situation. The CE cache return does not. ZEND_MAP_PTR_GET has no bounds check, so a non-NULL garbage slot gets treated as an initialized RTC and the observer walks off into nowhere. This PR mirrors the sibling paths. On a CE cache hit for an immutable class, extend local map_ptr from SHM before returning the class. I also added a regression-oriented test where practical. How I found it was by asking which quiet earlier path already knew to sync, then checking whether the CE cache fast path did the same. Commit dbd4c29887 even says the PFA load extend matches inheritance cache and script load. That sentence is the missing twin for CE cache. Similarity search ranks the dense crash narrative first and parks the real sibling far down the list. > Trail for this diagnosis was assembled with Vestige > https://github.com/samvallad33/vestige Please target the lowest actively supported branch this affects if you want a different base than master. Happy to rebase.