Adds two new commits on top of the existing PR #3 branch:

  1. The PR #1 fix cherry-picked: PoC's PDFDoc::replaceTextInDocument
     rename to snake_case + add_object write-back + escape-contract
     docblock + streams_scanned semantics + Phase-2 exhaustive sweep
     in the verify gate + namespace/named-arg fixes in
     poc-make-fixture.php. Same content as the corresponding PR #1
     fix; arrives here because PR #3 has a cherry-pick of the PoC
     and the PR #1 review's blockers apply to that copy too.

  2. This commit: PR #3-specific fixes from Wilco's first-pass
     strict review.

🔴 PR #3 Blocker
  - PHP 7.4 named-args in poc-make-fixture.php — addressed by
    commit (1) above (the cherry-picked PR #1 fix replaces named
    args with positional and pins gzcompress level to 6).

🟡 PR #3 Concerns
  - get_stream(false) on chain failure now returns `false` (matching
    upstream's pre-refactor `return p_error(...)` semantics) rather
    than the raw $this->_stream. Callers using the `if ($decoded ===
    false) continue;` idiom get the skip behaviour they did before
    the dispatcher refactor. spec.md REQ-5 scenario updated to match.
  - build_flate_params /Columns default fixed from 0 → 1 per
    PDF 1.7 §7.4.4.3 Table 8. Hidden today because Predictor=1
    short-circuits; would have bitten the moment a PNG-predicted
    stream landed without explicit /Columns.
  - REQ-2 (encode-decode round-trip lossless) spec scenario
    tightened to "Predictor absent or = 1" — round-trip with a
    non-trivial PNG predictor is acknowledged as out of scope (no
    encode-side predictor support); future `feat-flate-predictor-encode`
    closes the gap.
  - design.md D1 wording fixed from "We add two `private` helpers"
    to "We add two `protected static` helpers", matching what
    shipped. Visibility choice justified (test-suite subclasses can
    stub for chain-ordering assertions; matches FlateDecode).
  - design.md D6 rewritten to reflect what the gate actually
    exercises (5 contract scenarios including the new REQ-3 smoke
    test) instead of the original "synthetic two-filter PDF"
    promise. Two-filter ordering is locked at spec layer but
    proved inductively by upstream-PRs #1-#4 each pairing the new
    codec with /FlateDecode.
  - examples/poc-filter-chain-roundtrip.php gained a REQ-3 block
    smoke-testing /DecodeParms positional routing — single-filter
    chain with explicit `/DecodeParms [<</Predictor 1 /Columns 4>>]`
    that round-trips cleanly.
  - docs/upstream-prs/05-filter-chaining/{proposal,design,tasks}.md
    no longer carry the duplicated 18-line "Implementation note"
    block. Each file now links to
    `openspec/changes/feat-filter-chain-dispatch/design.md` as the
    canonical artefact — single source of truth.
  - docs/upstream-prs/README.md now explicitly explains the two
    numbering schemes: directory `01..08` is the upstream-submission
    order; fork PR numbers are the local landing order. Foundation
    (`05`) lands first locally so dependent codecs (`01..04`) can
    attach. Cross-references use the `upstream-PR #NN` form.
  - replaceTextInDocument camelCase fixed — via the PR #1 fix
    cherry-pick (commit 1 above) which renames to snake_case
    replace_text_in_document.

🟢 Minors deferred
  - normalise_filter_chain dead defensive branch — the branch
    handles a `null` input that may or may not be reachable
    depending on PDFObject construction path; leaving as-is.

Verification: both poc-replace-text.php (PR #1 gate) and
poc-filter-chain-roundtrip.php (this PR's gate, now with the REQ-3
smoke test block) exit 0 after these two commits.

NOTE on the stacked-PR / no-force-push approach: this PR's commit
diff still references the OLD scaffold content from PR #2 (the
pre-rewrite spec.md / proposal.md / etc.). PR #2's mechanical
pass (REQ-NNN numbering + GIVEN clauses + Status/Purpose stub
headers) is shipped on `chore/openspec-scaffold` and will arrive
here naturally when this branch is rebased onto an updated
`work/text-replacement` after PR #2 merges. The spec amendments in
this commit will then merge with PR #2's rewrites — small expected
conflicts in spec.md's REQ-5 + REQ-2 scenarios, resolvable inline.

feat(runlength): RunLengthDecode encode + decode + chain wiring (PR #2, stacked on #4)

feat(lzw): LZWDecode + FlateDecode predictor refactor (PR #4, stacked on #6)

Blockers:
- Only the first match per TJ operator was processed. processTjArray
  returned on the first hit; outer caller advanced past the entire
  TJ. Multi-needle TJs and same-needle-twice-in-one-TJ
  under-counted replacements_per_needle. Rewrote with an outer
  while-loop that re-resolves fragment texts after each splice and
  continues until no remaining needle matches. New REQ-006 in
  spec.md anchors the contract with two-needle and same-needle-
  twice scenarios.
- Missing isset check on $stats['replacements_per_needle'][$needle]++
  in processTjArray. Lazy-init kept as a belt-and-braces guard
  (the entry point already pre-keys via array_fill_keys, but the
  guard survives future entry-point refactors).
- Odd-length hex silently dropped a char (@hex2bin($hex) ?: '').
  PDF 1.7 §7.3.4.3 mandates implicit trailing-zero padding. Now
  pads via `if (strlen($hex) & 1) $hex .= '0'`. New REQ-005
  scenario covers this.
- Non-spec leniency: numeric tokenizer accepted [-+\d.eE]. PDF 1.7
  §7.3.3 forbids exponent notation in Numeric Objects. Tightened
  to [-+.0-9] so a producer's `e` glyph after a hex CID can't be
  swallowed as part of a number. New REQ-005 scenario covers this.
- Phantom-ticked tasks 5.4 and 5.5 (no fixtures). Reverted to
  unchecked with explicit deferral notes.

Concerns:
- Dead $matchedOnce assignment removed via the rewrite.
- Comments not treated as whitespace inside TJ arrays. Now skipped
  per PDF 1.7 §7.2.4. REQ-005 scenario.
- tj_arrays_modified diagnostic key now pre-initialised at top of
  replace_text_in_document (contract no longer fragile).
- preg_match-per-byte for whitespace replaced with strpos against
  the 6-byte PDF whitespace set (~50× faster on large TJ arrays).
- Shape inheritance: placeholder now always emitted as literal
  regardless of first matched fragment's shape (matches D2
  documented contract).
- `@hex2bin` defensive `@` removed — the odd-length check above
  makes the warning unreachable; PHP errors for other malformed
  shapes now surface to callers explicitly.
- end() / reset() pointer-advancing avoided in the new render path
  (group-based emission uses numeric indexing).
- Triplicate Implementation Note blocks in docs/upstream-prs/07-tj-
  flattening/{proposal,design,tasks}.md replaced with canonical
  pointers (same pattern as PRs #1/#2/#3/#4/#5/#6).
- Tf set inside q/Q leaks documented as a known gap (q/Q stack
  not maintained); deferred to a follow-up.

Verification: all 7 gates green (poc-replace-text,
poc-tounicode-cmap, poc-tj-flattening, plus the 4 filter PoCs).

Also fixed in this commit: poc-tj-flattening.php was calling
$doc->replaceTextInDocument() (camelCase) which doesn't exist after
PR #1's snake_case rename. Updated to replace_text_in_document.

feat(asciihex): /ASCIIHexDecode filter (SAPP PR #1)

feat(lzw): /LZWDecode filter + applyPngPredictor refactor (SAPP PR #4)