[vitormattos]

Problem

The former Behat test lockfile relied on estahn/json-query-wrapper, which triggers PHP 8.5 deprecations. Updating to the released libresign/nextcloud-behat v1.6.4 fixes those failures but changes how raw jq string output is decoded. Six assertions compared escaped JSON text instead of semantic policy values.

Changes

• Require libresign/nextcloud-behat ^1.6.4 and update the integration lockfile.
• Restore the stable35 activity-preference Behat step needed by cancellation scenarios.
• Use jq fromjson to verify the actual allowGroups/denyGroups contents, including lengths, in all six affected assertions. Production policy logic is unchanged.
• Keep Behat 3. The separate upstream nextcloud-behat#131 proposal is not a merge prerequisite: the updated tests are representation-independent.

Validation

• PHP syntax (8.3), integration Composer manifest validation and git diff --check: passed.
• All 21 jq expressions checked against synthetic JSON: passed.
• Earlier v1.6.4 CI passed 199/201 Behat scenarios; the other two failed on string escaping and skipped later checks.
• Full stable35 CI on 9a65a856e3ba finished: 57 successful checks, 7 skipped, 0 failures. All four PHPUnit and four Behat workflows passed. SQLite/PHP 8.5 ran 201 scenarios (201 passed), 3,251 steps (3,251 passed).

No unrelated production or dependency changes.

Review handoff

Review this dependency/Behat compatibility PR before #9331. The four support files also present in #9331 are byte-identical; after this PR is merged the base of #9331 can be refreshed. Both branches have passed their independent stable35 CI matrices.