Groups: bring the compat-test skill's REST checks up to date - #2226

GatherPress 0.36.0 renamed the comment above the event email's button
to `<!-- RSVP Button: only when registration is still open. -->`. Both
our rewrites matched the old `<!-- RSVP Button -->` exactly, so they
quietly stopped matching. The button was no longer rebuilt as a table,
and the organizer's own publish notification kept its "RSVP Now"
button again (#2074).

Match the marker as a prefix, so either shape works while the code and
the plugin version roll out. The rebuilt button takes the darker blue
0.36.0 switched to for WCAG AA contrast.

The email test's fixture is now 0.36.0's rendered markup, with cases
for the old marker and for a closed event, whose email keeps the marker
but has no button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- API contracts: `Event::$rsvp` is gone, so the Groups contract checks
  `Event::$post` and `Rsvp::is_enabled()`. The recurring-events contract
  no longer reads any property, so its property check is removed
  rather than left as a skipped test with an empty data provider.
- Recurring-events tests build an `Rsvp` directly instead of going
  through `Event::$rsvp`.
- Fixtures use the 0.36.0 names for renamed keys:
  `gatherpress_capacity` for `gatherpress_max_attendance_limit`, and
  `guest_limit` for `max_guest_limit`. The old names still resolve
  until 0.37.0, but only through a fallback that release removes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bumps the pinned release in the PHPUnit container, both CI workflows,
and the compat-test skill's install commands. The skill was still on
0.35.0 for both GatherPress and GatherPress Alpha; the 0.35.x patch
bumps had only touched the workflows.

On production, GatherPress Alpha 0.36.0 has to run on each site after
the bump: it moves the renamed settings and post meta (capacity,
guest limit, and others) and drops the literal "to" separator old Event
Date blocks saved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…Cal cache

GatherPress 0.36.0 caches iCal responses keyed on the queried post
(GatherPress#2067). Every occurrence of a series is the same post,
told apart only by the `gpre_occurrence` query var. So whichever date
was downloaded first got served for every other date: adding Nov 25 to
a calendar put it on Nov 18.

The cache key can't be extended, so `gatherpress_calendar_max_age`
returns 0 for occurrence requests. Those downloads render fresh and are
sent uncached, as before 0.36.0. Series downloads and feeds keep the new
caching.

Covered by a test that renders two occurrences' downloads and compares
their DTSTART. It fails without the filter. The compat-test skill notes
the trap for future bumps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

GatherPress 0.36.0 appends a visually hidden "(opens in a new tab)" to
links that open a new tab (GatherPress#2258). The Google and Yahoo links
now announce it, so an exact-name match no longer found them, even
though their hrefs were right.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The spec posted to a hardcoded `https://events.wordpress.test/`, so it
could only reach a stack on port 443. Use `siteOrigin()` like the
Playwright config does, so it also runs against a local stack on
another port.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

GatherPress 0.36.0 keeps one rendered copy of each calendar download and
feed for 15 minutes, shared by every viewer, and sends it as
`Cache-Control: public`. Our protected-event gate makes that output
depend on the viewer: the venue is left out unless they have the
password or can edit the event. So whoever downloaded first decided
what everyone got. An organiser's copy gave a protected event's address
to logged-out visitors, and a visitor's copy left it out for the
organiser.

Return 0 from `gatherpress_calendar_max_age` on group sites. Every
response is rendered fresh and sent `no-cache`, as before 0.36.0.

The test downloads through GatherPress's cached path as an editor, then
logged out, and fails without the filter.

Reported by bor0 in review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

GatherPress 0.36.0 copies each event's venue address and coordinates
into `geo_address`, `geo_latitude`, `geo_longitude` and `geo_public`
meta, exposed in REST for geodata plugins (GatherPress#2322).
`hide_event_details_in_rest()` already removed the venue term from
protected events, but not these. So a logged-out request still returned
the street address and exact coordinates.

Unset all four for the same callers the venue term is hidden from.
Editors still get them.

Reported by bor0 in review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This PR rewrote the "is RSVP enabled" checks in check-in's
`resolve_event()` and in the recurring events `update_rsvp()` route,
but neither had a test: removing either left the suites green. Add one
for each, with RSVP switched off: check-in refuses the list, the toggle
and walk-ins, and the occurrence route refuses the RSVP. Neither saves
anything.

Reported by bor0 in review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The previous commit removed the `geo_*` fields at priority 10 on
`rest_prepare_gatherpress_event`. GatherPress's `Geo_Sync` runs after it
on the same hook. When an event's stored geo meta is stale, it
recomputes the values and writes them back into the response. That put
the address and coordinates back for logged-out visitors on the first
read after the upgrade, after a venue's address changes, or after an
event's venue changes. Later reads were clean, so the leak was easy to
miss.

Hook the gate at 20, after GatherPress's callbacks. The geo assertions
move into a test that clears the event's geo meta and runs the real
hook, which fails at 10 and passes at 20. The old test called the gate
directly and couldn't see the ordering.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

GatherPress 0.36.0 renamed `Event::$event` to `Event::$post`, and
check-in read `$event->post->ID` in five places. On 0.35.4 that property
doesn't exist, so the list, the toggle and both walk-in routes broke
whenever this code was live before the plugin pin. Thread the ID from
the request through `current_scope()` and `build_list()` instead, which
works on both versions and lets the code deploy ahead of the pin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

GatherPress 0.36.0 made `sanitize_textarea_field()` the email route's
sanitizer for the message, where 0.35.4 only used `sanitize_text_field()`
as a validator. Core's sanitizer deletes every `%XX` sequence, so a link
with an encoded Japanese or Cyrillic path lost that path in "Message
members". Swap in a sanitizer that strips tags and keeps the encoding;
the template still runs the message through `wp_kses()`.

0.36.0 also only renders the RSVP button while the event hasn't passed,
and that button is the email's only link. Emails are sent with no
occurrence in context, so a series is judged by its first date, and
every email about a running series went out with no link once that
date passed. When the button is missing, add a "View event" button in
its place. The event ID comes from `gatherpress_email_subject`, which
GatherPress applies right before rendering each copy. The button keeps
the marker and wrapper, so the organizer's publish copy still drops it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Since 0.36.0, `Event::save_datetimes()` snaps start and end to
00:00:00 and 23:59:59 whenever `gatherpress_is_all_day` is set. The
front-end form has no all-day field and always sends explicit times, so
an event once ticked "All day" in wp-admin ignored every time typed into
the form. Delete the flag before both save sites.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The route list had fallen 15 routes behind: check-in, export, group-info,
event RSVP and templates, the member preference routes, and ownership
transfer. List all 27 by registering file with their methods, and print
methods from the live check so a changed verb shows up.

`per_page` above 250 now fails validation with a 400 instead of being
capped, the role labels are spelled Organizer and Event Organizer, and
`/members/leave` is a DELETE that returns `rsvps_cancelled`. The About
tab no longer 403s since it moved to `/group-info`, so drop that known
issue and check the route's gate instead. Group Settings also gained an
Export tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>