Looking at various composer.lock upgrades from last night:

• Lock file maintenance Roave/BetterReflection#1489
• Lock file maintenance Ocramius/CodeGenerationUtils#437
• Lock file maintenance Roave/SecurityAdvisoriesBuilder#763

Although I violently agree with making things final, vimeo/psalm:6.6.0 introduced a breaking change in what's considered valid and not (and it's not just a shift due to type refinements):

https://psalm.dev/docs/annotating_code/supported_annotations/#api-psalm-api

Specifically, it seems like Psalm now requires things to be marked as API, whilst, tbh, that's only a Symfony thing.
The rest of us uses @internal for what isn't @api: see for example https://github.com/Roave/BackwardCompatibilityCheck/blob/448b845a54afd41a54d93c4403900211abda4b3c/src/DetectChanges/BCBreak/ClassBased/MethodRemoved.php#L61-L66

Unless I'm misunderstanding something, I'd recommend having the default psalm profile not having this requirement, and requiring to do so in a new major version, if it's a design decision.

If @api is only used for discovering unused code, then I'm fine with it: at least tests should be written, but in such case, the error message reporting ClassMustBeFinal is probably wrong.