Add wp-env skill for local WordPress development - #38

… security

Merges the six commits WordPress/agent-skills trunk was ahead by:

- ac16175 Add wp-env skill for local WordPress development (WordPress#38)
- ad58e37 Add plugin security guidance for escaping and AJAX (WordPress#63)
- f2f6af2 Fix Plugin/Theme header detection in PHP docblocks (WordPress#103)
- e9c58d5 Adding reference to webMCP at Playground Skill (WordPress#105)
- 9f4a603 chore: refresh upstream indices (WordPress#92)
- f1bac1f Add repository-wide CODEOWNERS for agent-skills maintainers (WordPress#108)

Conflict resolutions:

shared/references/wordpress-core-versions.json
  Kept ours. api.wordpress.org/core/version-check/1.7 reports 7.1.2
  (checked 2026-09-27); upstream's WordPress#92 snapshot stops at 7.1.1. The
  Gutenberg index merged cleanly: both sides already carry v24.0.0, and
  v24.1.0 is still at rc.1.

skills/wp-project-triage/scripts/detect_wp_project.mjs
  Kept ours. The fork already fixed WordPress#103's bug with `^[\s*#]*`, which
  matches every header line upstream's `^\s*\*?\s*` does, plus `#`-led
  lines. The detect_plugins.mjs half of WordPress#103 merged cleanly; the fork had
  not fixed that file. Both detectors now report docblock, bare, and
  non-plugin fixtures correctly.

skills/wp-playground/SKILL.md
  Kept the fork's frontmatter (Use-when opener, 6.9 floor, GPL license)
  and folded WordPress#105's "WebMCP site tools" into the description. Took WordPress#105's
  browser-workflow routing bullet in the fork's markdown-link style; it
  also drops the "Blueprint Editor" claim, which website.md never covered.

Clean merges: website.md now routes existing-site work to the new
webmcp.md, mcp.md, and sites-api.md references (the WebMCP tool names
match packages/playground/mcp in WordPress/wordpress-playground);
security.md gains escaping contexts and AJAX handler rules. wp-env
arrives exactly as upstream wrote it and is conformed and corrected in
the next commit. CODEOWNERS names @WordPress/agent-skills-maintainers,
which does not resolve in this fork; kept for tree parity with upstream.

The harness is not expected to pass at this commit: wp-env is not yet in
the skill inventory and skills/ changed without a version bump. The
follow-up commits close both.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…16.0 and route to it

Upstream's wp-env skill (WordPress#38) follows the @wordpress/env README, which
lags the package code in several places. Checked against the 11.16.0
tarball (published 2026-09-23) and, where behavior mattered, run:

- `composer` is not a `wp-env run` container. The package removed it
  (and `phpunit`), and validate-run-container.js throws on both. The
  list is now mysql, wordpress, cli, phpmyadmin (only when enabled), plus
  the tests-* containers.
- `wp-env run cli "wp rewrite structure /%postname%/"` fails. run()
  hands argv to `docker compose exec` with no shell, so the quoted string
  is looked up as one executable name ("executable file not found in
  $PATH", reproduced with docker exec). The command is now unquoted, with
  a short explanation.
- `wp-env run mysql mysql ...` fails: the database service is
  mariadb:lts (12.3.3 today), which ships `mariadb` and no `mysql`.
- `npx wp-env` resolves the unscoped `wp-env` npm package when the local
  install is missing (a third-party "Security PoC" package), and npm
  assumes --yes in a non-interactive shell. Replaced with the README's
  own `npm exec --no -- wp-env`.
- `cleanup` and `destroy` block on a confirmation prompt unless
  `--force`; the skill now says to get the user's go-ahead and pass it.
- Override files merge `config`, `mappings`, and `lifecycleScripts`
  (merge-configs.js), not only the first two.
- The invalid-source error is `Invalid or unrecognized source: "<value>"`,
  and a relative path without a leading `.` is parsed as a GitHub repo.
- The tests environment still starts by default on 8889 but is
  deprecated with a startup warning; the skill names the
  `"testsEnvironment": false` opt-out and the `--config` replacement.
- `--auto-port` is ignored when CI is set.

Fork conventions: the 6.9 floor per docs/compatibility-policy.md (wp-env
covers no 7.0-only API), the license field, a wp-playground boundary in
the description, and "verified against @wordpress/env 11.16.0" in prose.
@wordpress/env is not a drift-registry upstream, so it carries no
`verified through:` marker.

Registration: docs/skill-set-v1.md lists 22 skills. The router sends
wp-env / .wp-env.json requests to wp-env (upstream still routes wp-env
to the planned wp-testing skill) and WordPress#105's WebMCP / Playground MCP
terms to wp-playground's website.md. wp-playground's escalation now
names the wp-env skill.

assertWpEnvPrecision pins the corrections and the fork-only router
entry. It fails on upstream's original SKILL.md, and each of its six
exclusions matches a line in that original.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Ships the upstream merge and the corrections that followed it: the new
wp-env skill (upstream WordPress#38), checked against @wordpress/env 11.16.0 and
routed from wordpress-router; WebMCP, Playground MCP, and Sites API
routing for wp-playground (WordPress#105); plugin escaping and AJAX guidance (WordPress#63);
and the docblock plugin-header fix in detect_plugins.mjs (WordPress#103).

The release-conformance gate requires a bump whenever skills/ changes after
the last version change, and nine skill files changed since 1.11.0. A new
skill makes this a minor release. The manifests now list wp-env.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>