The ray, when intersecting the cardiod, must be orthogonal to the plane of incidence. It just so happens that the derivative of the cardiod's equation, as given in your question, gives the slope of the plane of incidence at that particular angle and $m \times \frac{dy}{dx} = -1$ as required!
But shouldn't the derivative of the cardiod's equation gives the slope of the tangent line? Well it does... to see this supposed discrepancy, we have to carefully assess the model that we're using.
Addendum: Don't stop with reading this answer! Check out robjohn's answer as well. Because there's a key question I don't ask: We see a caustic in the coffee cup, but which caustic are we seeing?
Now onto the analysis.
Let's fix our point source of light at the right of the circle, as in the diagram below at $P$. Physically, $P$ is where your incoming beam, exterior to the ring, is focused. Shifting the location of the point source would disrupt the cardiod and produce some other envelope. Keeping the point source on the circumference would keep the envelope of rays in the shape of a cardiod; in response to your comment, I think that's what is meant by "the catacaustic of a circle with respect to a point on the circumference is a cardioid."
(Source of the picture.)
Your first equation
$$m(\phi)={\sin 2\phi-\sin \phi \over \cos 2\phi-\cos \phi}$$
is slope of the path of the reflected ray. The angle $\phi$ is being measured from a coordinate system at the center of the circle, measured counterclockwise from the positive $x$-axis. This is convenient, since the law of reflection will indeed give $(r,\phi)\to(r,2\phi)$.
Now let's match the cardiod in the diagram. It looks something like$$r = a(\cos \theta -1)$$
This curve is a bit different from yours, due to how we're defining $\theta$. Anyway, we don't know $a$. It's not unit length if our circle is a unit circle. See here. Check the linked plots, and you'll probably notice that the circle isn't positioned properly. This is because $\theta$ is not measured from the center of the circle, but from the cusp of the cardiod. We're using two coordinate systems. Regardless, we can compare slopes in the two systems since they're translations. We still have
$$\begin{align*}
\frac{dy}{dx}(\theta) = \frac{dy/ d\theta}{dx/ d\theta} & = \frac{r' \sin \theta + r \cos \theta}{r' \cos \theta - r \sin \theta} \\ \\
& = \frac{-a\sin^2 \theta +a\cos^2 \theta- a\cos \theta}{-a\sin\theta \cos \theta - a\cos\theta \sin \theta + \sin \theta} \\ \\
& = -\frac{\cos 2\theta- \cos \theta}{\sin 2\theta - \sin \theta} \\ \\
& = -\frac{1}{m(\theta)}
\end{align*}
$$
For reference, I marked a sample ray in yellow. It reflects at $\phi = \frac{\pi}{2}$ and the reflected portion has slope $m(\frac{\pi}{2}) = 1$. Now, without proving it, it does appear that at $\theta = \phi$, the reflected ray and the tangent have parallel slopes. Neat. But why don't the formulas give this result? Why does $\frac{dy}{dx}(\frac{\pi}{2}) = -1$ for our ray? This is the negative reciprocal.
Recall the cardiod has formula $r = a(\cos \theta -1)$. Let's examine how one of these points is mapped. At $\theta = \frac{\pi}{2}$, we have $r = -a$. This point is on the opposing side of the cardiod! The slope of this tangent given by the derivative is actually that of the pink line below.
Interestingly, the pink tangent on the opposing side of the cardiod appears to be perpendicular to the reflected ray itself. That is, it is parallel to the plane of incidence.
Thanks for the cool question.
