Maintain dependencies, CI, tests, and repository hygiene

[ashfame]

Summary

This draft integration PR implements the approved maintenance program recorded in plan.md through merged child PRs #200 through #218. It upgrades causal dependencies where safe, makes Node/PHP CI reproducible, validates both browser packages and Firefox metadata, aligns local and hosted test environments, removes abandoned Jest scaffolding, adds dependency upkeep and package metadata, and completes the authorized stale-branch cleanup.

This PR remains draft and unmerged for owner testing and explicit residual-security decisions.

Security outcome

Range-, scope-, and path-aware reconciliation resolves 84 of the 124 baseline Dependabot rows on the integration lock, including all five critical rows and the Composer alert. Forty baseline npm rows remain: 26 WPS, five React Router, three Concurrently plus WPS, two block-library, two Babel plus WPS, one web-ext, and one web-ext plus WPS.

The final npm audit reports 111 affected package/effect keys across 60 GHSAs: 87 high, 15 moderate, nine low, and zero critical. Seven applicable npm-audit GHSAs are not represented in the unchanged default-branch 124-alert set and are mapped in plan.md. The published Playground client also hides an upstream bundled body-parser@1.20.5 source risk even though alert 171 is resolved under the repository lock-path rule.

No override, downgrade, alert dismissal, extra ignored Firefox bundle, or silent broad migration was used. The retained rows are documented blockers where available upgrades retain affected paths, add another applicable advisory or extension-security warning, or require a broad migration.

GitHub continues to show all 124 original alerts because Dependabot evaluates default-branch manifests; recalculation cannot occur until this draft reaches trunk.

Developer-facing changes

• Node 24 is selected by .nvmrc and enforced as >=24 <25; CI uses lockfile caching and npm ci.
• Schema generation precedes TypeScript checking; pull requests run lint, type-check, both production builds, packaged-reference validation, and exact Firefox linting.
• Aggregate npm build commands now build both Firefox and Chrome targets, and obsolete Jest scaffolding/documentation is removed.
• Firefox declares the provisional Gecko ID, truthful data categories, corrected icon path, and minimum version 142.0; changing the ID after first publication would create a distinct identity.
• Local wp-env uses latest-stable WordPress and PHP 8.4; hosted PHP matrices cover 8.3/8.4 with MySQL 8.0 and deterministic WordPress fixtures.
• PHPUnit is 9.6.33 with the matching schema; Composer audit, PHPCS, and the complete PHPUnit suite are gated.
• Monthly grouped npm/Composer version upkeep, private npm identity/version metadata, an accurate Composer description, and root-only SQL backup ignores are added.
• Ten recoverable stale branches were deleted after documentation; attempt-twitter, fix-test-wix, and npm_package_updates remain preserved at their exact recorded SHAs.

No application public API, stored-data schema, application behavior, license file, or license metadata change is intended.

Automated validation

The final child and current integration head run Node 24 clean install, JavaScript/style lint, schema-aware type-check, Firefox and Chrome production builds, nine-reference validation for each package, and Firefox lint with zero errors/notices and only the exact allowed side-panel API warning while ignoring only generated app.js.

PHP 8.3 and 8.4 jobs run clean locked Composer installation/audit, deterministic schema and WordPress test setup against MySQL 8.0, complete PHPCS, and the full PHPUnit suite. The final child PR #218 passed all five hosted checks; this integration head is running the same gates.

Manual testing required

• Load build/production/firefox and build/production/chrome unpacked; verify the Firefox sidebar and Chrome side panel open without console errors.
• Start WordPress Playground in both targets; verify the asynchronous Playground/vendor bundle loads and assess startup, parse, and memory behavior around the approximately 21.2 MiB application bundle.
• Import representative navigation and multiple pages, preview them, and verify content, links, media, and layout.
• Reload and close/reopen both browsers; verify session persistence and inspect browser-extension plus WordPress/PHP logs.
• Exercise Firefox and Chrome development watch/start commands; change a copied manifest/icon/plugin/schema input and verify one correct recopy without an output-triggered loop.
• Reconfirm the provisional Firefox Gecko ID and data categories before first publication, the single allowed unsupported-API warning, and absence of any additional manifest or generated-bundle diagnostic.

After manual testing, explicitly decide how to handle the documented 40 baseline residual rows, seven audit-only advisories, and hidden Playground source risk before marking this PR ready or merging it.