Ah of course, that was the framing I missed to make sense of it 
So indeed, copying over this part
# add www and turn on https in same rule
RewriteCond %{HTTP_HOST} !^www\. [NC,OR]
RewriteCond %{HTTPS} !on
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://www.%1%{REQUEST_URI} [R=301,L,NE]
## hide .html extension
# To externally redirect /file.html to /file
RewriteCond %{THE_REQUEST} \s/+(.+?)\.html[\s?] [NC]
RewriteRule ^ /%1 [R=301,NE,L]
to the Kirby htaccess should have you covered re your original question, as your “public URLs” never really contained a .html suffix in the first place (your current setup hid that). And indeed, no .php URL suffixes should ever surface anywhere, as Kirby takes URLs without any file endings and channels them into its own index.php in the background.