How PHPStan and Psalm differ in level systems, generic type support, and security analysis — plus the baseline workflow that makes adoption on legacy code survivable.