Add WordPress integration test suite and CI

[henry-mosh]

What

Adds automated tests to a plugin that had none, plus CI, and fixes two
outbound-call gaps found while writing them.

217 tests, WordPress integration rather than mock-heavy units — almost
every branch in this plugin touches WordPress state (transients, options,
template_redirect conditionals, REST, cron). The CiteCue delivery API is
faked at the wp_remote_get layer, the single choke point every outbound
call passes through, so no test touches the network. WordPress core and its
test library come from Composer: setup is composer install plus an empty
database.

Coverage

• Crawler UA matching (longest-token-wins, robots.txt-only tokens excluded)
  and registry refresh (version floor, bundled-token floor, junk payloads)
• Request eligibility — feeds, previews, robots, sitemaps, logged-in users,
  AJAX/cron, and the WooCommerce store pages
• Every delivery outcome: 200/304/401/404/5xx/timeout, including stale-serve
  and the "404 evicts a previously cached body" rule
• Circuit breaker and the per-minute lookup budget
• llms.txt: freshness window, revalidation, eviction, outage behaviour
• Ingest HMAC auth: replay rejection, ±300s window boundaries, rate limiting,
  and that unsigned junk cannot exhaust the budget
• Ingest behaviour: status cap, local-edit protection, trashed pushes, type
  conflicts, sanitisation
• Settings sanitation and the activation/cron/uninstall lifecycle

Production changes

Testability. Citecue_Proxy and Citecue_Llms_Txt each split into a
decide() returning what should happen and the existing serve() that emits
headers and calls exit. Behaviour-preserving — all branching moved into
decide(), which is what the tests drive.

Two fixes on the llms.txt path, the one endpoint served to every visitor
rather than only to bots:

• A 404 (llms.txt switched off for the project) evicted the cached copy but
  recorded nothing, so every subsequent hit made a fresh outbound call. Now
  negative-cached for 60s, matching the page path.
• The per-minute lookup budget only covered the crawler path, leaving llms.txt
  uncapped — and usable to sidestep the ceiling on the other path. The budget
  moved to Citecue_Cache alongside the circuit breaker, and both paths now
  share it. Same filter name and default, so no change for existing installs
  beyond the wider coverage.

CI

Static checks (php -l, WPCS, PHPCompatibility) plus the suite on PHP
7.4/8.2/8.4 against current WordPress, PHP 7.4/8.3 against WordPress 5.9/6.5,
and a separate job against a real WooCommerce.

WordPress 5.9 rather than the plugin's declared 5.8 floor: WordPress's own
test library only gained PHPUnit 9 support in 5.9, and 5.8 hard-fails with
"compatible with PHPUnit up to 7.x". 5.8 support rests on the
PHPCompatibility checks and manual verification.

Not covered

• class-citecue-admin.php (564 lines) — nonce checks and the test-connection
  handler need the same decide()/emit split, since they are wp_die and
  redirect-and-exit throughout.
• tests/cases/test-ingest-products.php is written but was never executed:
  it needs a real WooCommerce, and wordpress.org was unreachable from the
  environment it was written in. The test-woocommerce CI job is its first
  real run — expect to iterate there.

🤖 Generated with Claude Code