Run the integration suite in CI

[alexdumea]

Context

The plugin declares three PHPUnit suites in phpunit.xml.dist: unit (no kernel), integration (booted kernel and database) and functional (routes driven in-process through Symfony's KernelBrowser). A lane is one of. the plugin's docker-provisioned Shopware installations per supported version (6.5, 6.6, trunk) that CI tests against. The unit suite runs in the php-quality CI job. The functional suite runs inside the lane job, where bin/ci-smoke.sh provisions a docker-based Shopware per version and then runs PHPUnit inside it.
tests/Integration/ holds two tests, Migration/Migration1780328112CreateUcpConfigTableTest.php and System/SystemConfig/SystemConfigSchemaReadableTest.php, and neither runs anywhere: nothing in .github/ or bin/ calls that suite. phpstan.neon.dist excludes tests/Functional but not tests/Integration, so the two files are analysed by PHPStan and never executed. SystemConfigSchemaReadableTest guards a bug that shipped once: the 6.5 configuration schema applied by CompatConfigReader broke the Basic Information page under Settings on Shopware 6.7.

Acceptance criteria

• bin/ci-smoke.sh runs --testsuite integration next to --testsuite functional in the block currently enabled by the environment variable CI_SMOKE_RUN_FUNCTIONAL (line 528). Both suites need
  KernelLifecycleManager and the lane's own PHPUnit binary, which is why they share the block. The variable is renamed to CI_SMOKE_RUN_PHPUNIT and every caller in .github/workflows/ is updated.
• The same block gets a stage that switches one sales channel to the strict signature policy with bin/console ucp:config:set --sales-channel=<id> --signature-policy=strict, which writes the stored config row and therefore actually takes effect.
• tests/Functional/Ucp/UcpRequestContextGuardTest.php gets three tests, each sending an unsigned request under strict: on /ucp/v1/catalog/search it returns 401 (this is expected to pass today); on /ucp/a2a it returns 401 (expected to fail today); on an /ucp/embedded/ route it returns 401 (expected to fail today) /ucp/embedded/cart/{id}, with an allowlisted origin, the page is still served with 200 and text/html, because under the Embedded Checkout Protocol the page is loaded in an iframe that can't be signed and is authorized by the token in the URL. The two failing tests are marked incomplete or skipped The failing A2A test is marked incomplete with a link to the issue tracking the SDK deviation: the SDK's RequestContextListener::isUcpRequest() excludes /ucp/mcp, /ucp/a2a and /ucp/embedded /ucp/a2a from the signature check.
• The integration suite is green on all three lanes in CI.