The patch added for #1034892 sets the timestamp of every entry to 0 in
phar_flush(), not only when phar.phar is built during the package build,
so every phar created with the Phar API on Debian gets timestamps of 0.

OPcache takes a timestamp of 0 as "no timestamp available" and doesn't
cache the script (persistent_compile_file() in
ext/opcache/ZendAccelerator.c),
unless opcache.validate_timestamps, opcache.file_update_protection and
opcache.max_file_size are all disabled. Scripts included from such phars
are then compiled again on every include, and filemtime() on their
entries returns 0.

Using SOURCE_DATE_EPOCH when it is set (dpkg-buildpackage exports it) and
time(NULL) otherwise would keep phar.phar reproducible without changing
the phars users build.

php8.5 carries the same patch: the deb.sury.org build of 8.5.10 also
writes timestamps of 0.

Upstream discussion:
https://github.com/php/php-src/issues/19997#issuecomment-5832183937