Post Types, Blocks: let organisers list volunteers on the front end - #1987

Summary

Fixes #1282.

wcb_volunteer is the only participant post type registered as non-public. Two consequences, both reported in the issue:

• The Query Loop block's post-type control only offers types that is_post_type_viewable() accepts, so volunteers never appear in it.
• No block or variation covers volunteers, unlike Speakers / Sessions / Sponsors / Organizers.

The workaround organisers are pointed at today is to abandon the CPT entirely and tag attendees with a CampTix admin flag instead.

This registers volunteers the same way organisers are registered, and adds the pieces that make them renderable:

• wcb_volunteer becomes 'public' => true, gains 'rest_base' => 'volunteers' and shortlinks support.
• New Volunteers List core/query variation, mirroring organizers-list (avatar + title, excerpt, wcb_volunteer_team terms, pagination).
• avatar_urls registered on wcb_volunteer in the REST API — the wordcamp/avatar block inside the variation reads it.
• wcb_volunteer case added to the avatar block's post label.
• single-wcb_volunteer.php block template, registered in theme-templates/bootstrap.php.

How to review this PR

Suggested order: wc-post-types.php → inc/rest-api.php → the new variation → theme-templates.

Three decisions worth surfacing rather than making you reverse-engineer them:

• Why it's safe to publish the post type. _wcb_volunteer_email and _wcb_volunteer_first_time are registered with 'context' => array( 'edit' ) (inc/rest-api.php), so publishing the CPT does not put volunteer contact details into anonymous REST responses. test_volunteer_contact_meta_is_not_exposed_to_anonymous_readers pins that invariant. This is the half of the change most worth a second opinion.
• Why public => true rather than a narrower flag. wcb_volunteer_team has been registered with 'public' => true against a private post type since it was introduced, so the data model already assumed public exposure. @o-samaras noted on the issue that no rationale for the private registration could be found; I couldn't find one either. If the meta team knows of a deliberate reason, that changes this PR substantially — say so and I'll rework it to keep the CPT private.
• rest_base is a route change. /wp/v2/wcb_volunteer becomes /wp/v2/volunteers, matching the four sibling post types. Low risk while the CPT is non-public and undocumented, but it is a behaviour change and I'd rather flag it than bury it. Happy to drop it if you'd prefer.

The variation uses the hammer dashicon (the CPT's own menu_icon) rather than a custom SVG, since the four sibling variations use bespoke artwork I'm not in a position to design. A matching icon from design would be a welcome follow-up.

Test plan

• phpunit — WordCamp Post Types suite 56/56 passing (4 new)
• phpunit — full run shows no new failures vs. production (identical failure set; the 39 pre-existing failures are environmental: missing intl extension and the private wporg-mu-plugins repo)
• phpcs — no new violations introduced (diffed sniff output against production per file)
• npm run build in mu-plugins/blocks — clean; eslint clean on changed files
• Manual browser pass — not done. My local dev stack isn't provisioned, so this has not been verified in a rendered editor or front end.

New tests

public_html/wp-content/plugins/wc-post-types/tests/test-volunteer-public.php:

1. wcb_volunteer passes is_post_type_viewable() — the gate the Query Loop control uses.
2. /wp/v2/volunteers is registered.
3. A published volunteer's REST response carries avatar_urls for every rest_get_avatar_sizes() size.
4. Volunteer contact meta stays out of an anonymous view-context response.

Tests 1–3 fail against production and pass with this change. Test 4 passes both before and after by design — it's a regression guard on the invariant that makes publishing the post type safe, not a demonstration of new behaviour.

Manual test steps (not yet executed)

1. As an organiser, create two published Volunteers with wp.org usernames set, assigned to different Volunteer Teams.
2. Edit a page, insert Volunteers List from the inserter; confirm avatars, titles, excerpts and team terms render in the editor.
3. Confirm wcb_volunteer now also appears in a plain Query Loop's post-type control.
4. View the page logged out; confirm the list renders and volunteer titles link to a working single page.
5. Request /wp-json/wp/v2/volunteers logged out; confirm avatar_urls is present and no email address appears anywhere in the payload.