Preserve PHPUnit paths and harness intent

[chubes4]

Summary

• pass testRoot and phpunitXml through the recipe build phpunit CLI boundary
• mark modern recipe autoload-file values explicitly as PHPUnit harness autoloaders
• preserve that harness intent after input-mount path canonicalization in project bootstrap mode
• retain the existing direct-caller compatibility behavior when no explicit role is supplied

Fixes #1820.
Fixes #1821.

Why

A real mounted WPCOM PHPUnit recipe exposed two separate boundaries. The CLI dropped the configured test root and XML path, then the project-mode handler inferred autoload semantics from the literal /wp-codebox-vendor/autoload.php path. Canonical staging legitimately changes that path, causing the handler to misclassify the harness as a legacy project autoloader.

The explicit autoload-file-role=harness contract keeps semantic intent independent of path rewriting.

How to test

1. Run npm install.
2. Run npx tsx tests/phpunit-project-autoload.test.ts.
3. Run npm run test:runtime-services.
4. Run npm run build.
5. Confirm the project-autoload test executes the generated compatibility branch and keeps a staged /tmp/wp-codebox-inputs/.../autoload.php path as the harness.
6. Confirm existing direct callers without autoload-file-role retain the legacy project-autoload behavior.

Runtime evidence

A full WPCOM core/actions recipe with mounted inputs and disposable MySQL progressed past harness readability and WPCOM polyfill bootstrap after this change. The next independent blocker is missing PHP Sodium capability, tracked in #1825.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Sol and OpenCode/Homeboy
• Used for: Investigated runtime evidence, drafted the implementation and regression tests, and ran deterministic verification with Chris reviewing and owning the change.