Add real WordPress proof profiles and content-addressed receipts

[noeltock]

Problem

Headless validation and a successful JavaScript build do not prove that a generated plugin activates, registers in both runtimes, mounts in the editor, persists edits, loads styles on the frontend, or supports pattern overrides. One ok: true would hide which claims actually ran.

Solution

Add a proof ladder using exact-version wp-env and WordPress's Playwright utilities. Emit an immutable receipt with a status for each gate and content-addressed evidence.

Approach

• Add headless, runtime, editor, and full proof profiles.
• Install and activate the built ZIP in WordPress 7.1 Docker/MySQL.
• Check PHP registry, REST block type, and client registry independently.
• Insert through the visible inserter; edit every field class; save, leave, reopen.
• Publish and assert frontend semantics, links, media, assets, console, and PHP logs.
• Deactivate the generated static plugin and record exactly which saved HTML remains and which plugin-owned styles/editor controls disappear.
• Run the pattern-override fixture from Make generated blocks work with WordPress 7.1 pattern overrides #6.
• Capture pinned screenshots and a diff with an explicit threshold.
• Run Axe against editor and frontend subtrees and record manual review status.
• Give every gate pass, fail, skip, blocked, or not_applicable.

Out of scope

• Claiming full WCAG conformance from Axe.
• Treating Playground/SQLite as the only production proof.
• Silently auto-updating visual goldens in CI.

Acceptance criteria

• A required skipped/blocked gate prevents the selected profile from passing.
• Receipts pin generator, plugin, ZIP, input, WordPress, PHP, database, theme, browser, Node, and WordPress-package versions/hashes.
• Editor proof records pre-edit, saved, and reopened tree/content hashes.
• Frontend proof records status, subtree, asset requests, and runtime errors.
• Visual proof retains expected, actual, diff, environment, masks, and threshold.
• Accessibility proof retains full Axe output and manual-review status.
• Static deactivation proof distinguishes surviving HTML from lost registration, styles, scripts, and editor controls.
• A deliberately broken registration, save function, stylesheet, and pattern override each fail the correct independent gate.