AVRO-4298: [php] Reject negative union branch index

schemaByIndex validated only the upper bound (count > index), so a negative
index passed the check and then indexed $schemas[-1] => null, violating the
AvroSchema return type with a TypeError instead of a clean AvroException. Add a
lower-bound check (index >= 0) so a negative branch index is rejected with
AvroSchemaParseException. Adds tests for negative and too-large union indices.
(readEnum is already guarded via array_key_exists.)

Assisted-by: GitHub Copilot:claude-opus-4.8

Author: iemejia

lang/php/lib/Schema/AvroUnionSchema.php

@@ -98,7 +98,7 @@ public function schemas(): array
      */
     public function schemaByIndex($index): AvroSchema
     {
-        if (count($this->schemas) > $index) {
+        if ($index >= 0 && count($this->schemas) > $index) {
             return $this->schemas[$index];
         }
 

lang/php/test/DatumIOTest.php

@@ -316,6 +316,24 @@ public function test_read_map_rejects_count_beyond_stream(): void
         $this->decodeWith('{"type":"map","values":"long"}', $io);
     }
 
+    public function test_read_union_rejects_out_of_range_index(): void
+    {
+        // Index 5 (zig-zag long) is out of range for a 2-branch union.
+        $io = new AvroStringIO();
+        (new AvroIOBinaryEncoder($io))->writeLong(5);
+        $this->expectException(AvroException::class);
+        $this->decodeWith('["null","long"]', $io);
+    }
+
+    public function test_read_union_rejects_negative_index(): void
+    {
+        // A negative index must not wrap to a valid branch.
+        $io = new AvroStringIO();
+        (new AvroIOBinaryEncoder($io))->writeLong(-1);
+        $this->expectException(AvroException::class);
+        $this->decodeWith('["null","long"]', $io);
+    }
+
     public function test_read_array_of_null_not_falsely_rejected(): void
     {
         $count = 100000;