Bilder in vier Breiten, Releasearchiv fuer Hosting ohne Composer

Uploads werden weiterhin nach WebP umgewandelt, jetzt in vier statt drei
Breiten (480/960/1600/2400) und ohne Hochskalieren. Hintergrundbilder
waehlen ihre Variante je Geraet, weil CSS kein srcset kennt.

Dabei kam ein Fehler heraus, den erst der Browsertest zeigte: der
Dokumentpruefer erlaubte drei sources je Bild, also war mit der vierten
Variante jedes Dokument mit einem Bild ungueltig - ohne sichtbare Meldung.
Die Grenze haengt jetzt an MediaLibrary::WIDTHS.

Geteiltes Hosting hat meistens keinen Composer. scripts/build-release.php
baut deshalb auf einem Build-Rechner ein Archiv mit fertigem vendor/ ohne
Entwicklungspakete, samt SHA-256. Der Updater bricht ab, wenn ein Update
composer.lock aendert und Composer auf dem Server nicht aufrufbar ist,
statt mit einem unpassenden vendor/ weiterzulaufen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Ops/CommandRunner.php

@@ -12,6 +12,9 @@ namespace App\Ops;
  */
 final class CommandRunner
 {
+    /** @var array<string, list<string>|null> */
+    private array $resolved = [];
+
     public function available(): bool
     {
         if (!function_exists('proc_open')) {
@@ -79,9 +82,41 @@ final class CommandRunner
         return ['ok' => 0 === $exit, 'exit' => $exit, 'output' => trim($output)];
     }
 
-    /** Whether an executable can be found at all, so a missing one is reported, not guessed at. */
+    /**
+     * Whether an executable can be found at all, so a missing one is reported, not guessed at.
+     *
+     * On Windows several of these are batch files, and proc_open without a shell cannot start a
+     * .bat - which reported "composer is not available" on a machine that has it. The variants are
+     * tried in order, and the one that answers is remembered for the next call.
+     */
     public function has(string $executable, string $cwd): bool
     {
-        return $this->run([$executable, '--version'], $cwd, 30)['ok'];
+        return null !== $this->resolve($executable, $cwd);
+    }
+
+    /** The spelling of a command that actually starts here, or null. */
+    public function resolve(string $executable, string $cwd): ?array
+    {
+        if (array_key_exists($executable, $this->resolved)) {
+            return $this->resolved[$executable];
+        }
+        $candidates = [[$executable]];
+        if ('\\' === DIRECTORY_SEPARATOR) {
+            // On Windows composer is a .bat, and CreateProcess cannot start a batch file on its
+            // own - it needs the command interpreter. The argument list stays fixed, nothing from
+            // a request ever reaches it.
+            $candidates[] = [getenv('COMSPEC') ?: 'cmd.exe', '/c', $executable];
+        }
+        // A phar in the project is the way on hosting where nothing is installed globally.
+        if (is_file($cwd.'/'.$executable.'.phar')) {
+            $candidates[] = [PHP_BINARY, $cwd.'/'.$executable.'.phar'];
+        }
+        foreach ($candidates as $candidate) {
+            if ($this->run([...$candidate, '--version'], $cwd, 30)['ok']) {
+                return $this->resolved[$executable] = $candidate;
+            }
+        }
+
+        return $this->resolved[$executable] = null;
     }
 }