[Website] Enable the WordPress sandbox only with ?reprint - #4510

Replaces #4510.

Make the WordPress origin split opt-in with `?reprint`. This PR contains
the runtime changes and tests. #4468 builds on it to add the WP Cloud
host and deployment wiring.

With a sandbox origin configured, the behavior is:

| Open Playground with | WordPress runs on |
| --- | --- |
| No `reprint` parameter | `playground.wordpress.net`, as before |
| `?reprint` (including an empty value) | `wasm.wordpress.net` |

The address bar, Dock, PHP runtime, OPFS, and picked directories stay on
`playground.wordpress.net` in both cases. Existing links and embeds keep
the single-domain behavior. A direct SDK embed can opt in with
`/remote.html?reprint`.

## How it works

The app reads the flag at startup and passes it to each `remote.html` it
opens. Switching sites in the SPA keeps that choice, even if navigation
removes the query string. Reloading without the flag returns to one
domain. The choice is not saved in site metadata.

`remote.html` sends the selected mode in PHP's boot message. It cannot
rely on a worker-script query parameter: our asset cache ignores query
strings, and a cached response can carry the URL from a tab that used
the other mode. The mixed-tab test caught that problem.

One app service worker supports both modes at the same time. Tabs do not
replace it with different mode-specific workers. Ordinary sites use its
existing HTTP relay. Opted-in sites use the sandbox helper and
explicitly return 404 for their app-origin HTTP route, so that route
cannot render their WordPress HTML on the app origin.

Both modes share one build and the same app-host asset URLs. No second
copy of PHP or WordPress is needed. Production host routing is added
separately in #4468; this PR does not change the deployment scripts.
Without a configured sandbox, both modes stay on the app origin. Popups,
thumbnails, and shared runtimes follow the selected domain.

## Limits

**This is a rollout flag, not full storage isolation.** An ordinary
Playground runs user JavaScript on the app origin. It can still access
app OPFS and CacheStorage used by opted-in sessions. Reopening a saved
Reprint clone without the flag also runs its WordPress code on the app
origin again.

The other origin-split limits remain: sandbox sites share an origin, and
WordPress can still embed a fresh app/API document.

## Testing

Local checks passed: the build, lint and type checks, 109 remote unit
tests, the startup-mode and popup unit tests, and 8 Chromium E2E checks.
These cover mixed tabs, warm script caches, SPA site switching,
saved-site reopening in either mode, app-route rejection, parent
OPFS/API boundaries, HTTP bodies, database popups, thumbnails, and
shared downloads. The existing website test helper opts into the sandbox
in two-host CI; the full suite is not duplicated. The new mixed-mode
checks run in the existing browser matrix.

To try it, open one tab normally and another with `?reprint`. Check
their WordPress frame domains. Switch sites, save and reopen a site, and
open a database tool. Reload the opted-in tab without the flag and
confirm WordPress returns to the app domain. Firefox and WebKit still
need their CI run.