refactor: move the tax id, deploy, fragment and logo decisions into pure classes in src

[YvesCesar]

The decision logic of the theme lived in global functions next to the hooks, so every test of it needed WordPress and a database. This moves the logic that only takes values and returns values into classes in src/, tested without WordPress. What reads options, files, requests or the HTTP API stays in inc/ and keeps its integration tests.

Classes

Each one is a final class with static methods, loaded with require_once by the inc/ file that uses it, so the theme still needs no Composer autoloader in production.

• TaxId: the CPF and CNPJ check digits (numeric and alphanumeric CNPJ) and which error a billing value gets, error_code(). inc/cpf-cnpj.php keeps the hooks and maps each error code to its translated message.
• SiteDeploy: the webhook signature, the GitHub user agent, the workflow name of a payload, whether a run is the production deploy or the start of the deploy (the repository, branch and workflow come in as arguments, read from the settings by inc/github-site-webhook.php), the merged pull request of a commit and the text of the sync comment.
• SiteFragment: the site origin, the language tag and storage key of a locale, the fragment URL, the asset URLs of a fragment, the locales the header links to, the lookup order of the locales, and the removal of the asset attributes and rewriting of root-relative URLs.
• Logo: the URLs an <img> may load from src and srcset, and the markup that swaps it for the LibreSign logo per color scheme.

One difference: a payload field that is not text, such as a workflow name sent as a list, now reads as an empty string. It used to read as "Array" with a PHP warning. GitHub does not send that, and neither value matches a configured workflow, so only the workflow_name echoed in the ignored response changes.

The global functions these replace were only called from inside the theme and are removed: libresign_theme_validate_cpf(), libresign_theme_validate_cnpj(), libresign_theme_verify_github_webhook_signature(), libresign_theme_is_github_hookshot_user_agent(), libresign_theme_site_deploy_workflow_name_from_payload(), libresign_theme_is_production_site_deploy_workflow_run(), libresign_theme_is_site_deploy_starting(), and the libresign_theme_site_fragment_* helpers for origin, locale tag, storage key, URL, asset URLs, header locales, asset attributes and root-relative URLs. The LIBRESIGN_THEME_SITE_FRAGMENT_DEFAULT_LOCALE_KEY constant became SiteFragment::DEFAULT_LOCALE_KEY.

Tests

• phpunit.xml.dist runs tests/Unit, with only the Composer autoloader; composer test runs it before the integration suite.
• The data provider cases of those functions moved from the integration tests to tests/Unit, mirroring src/. The integration tests keep the hooks, the settings, HTTP and files, plus one case that checks the configured branch reaches the production deploy decision.
• src is in PHPStan, in the PHPCS prefixes (LibreSign\WordPressTheme) and in the coverage of the integration suite.

Verification

• composer ci passes: 104 unit tests and 164 integration tests. The unit tests also run outside the WordPress container.
• The HTML of the home, /lost-password/, ?action=lostpassword, the shop, the cart, two product pages, the checkout redirect and a 404 is the same before and after this change, apart from the per-request ids (quantity field id and Store API nonce timestamp).
• Breaking one rule at a time in src/ makes a unit test fail: the CPF remainder, the CNPJ weight cycle, the CPF/CNPJ classification, the workflow check of the production deploy, the case of the signature, the script subtag of a locale, the protocol-relative URLs and the entities in the logo URL.