It is possible that your server has MultiViews (Apache Content Negotiation) enabled; when it is enabled and a file cannot be found apache will look for the same file but with any extension. To disable this you can add -MultiViews
to Options (if your host allows it)...
Options +FollowSymLinks -MultiViews
I would question why this is a problem for you though, if you do not link to any of your scripts without the .php
then how will people find them? Canonical URLs are only really an issue if there are links to these other pages.
Additionally, you could improve your php-based redirect to check the current request method and not redirect on POST requests, by inspecting $_SERVER['REQUEST_METHOD']
...
if ($_SERVER['REQUEST_URI'] != $_SERVER['SCRIPT_NAME'] and $_SERVER['REQUEST_METHOD'] != 'POST') header('Location: '. $_SERVER['SCRIPT_NAME']);