Align Playground runtime bootstrap dependencies

[chubes4]

Summary

• pin the Node Playground/PHP-Wasm package family atomically at 3.1.46
• make the root own @php-wasm/universal so Node loaders and WordPress wrappers share one runtime registry
• pin the published WordPress build assets at 0.9.19
• isolate the programmatic runner bootstrap at /internal/wp-codebox and delegate to Playground's canonical /internal/shared/auto_prepend_file.php

Fixes #1915.

Root cause

Two independent failures collapsed into the same runtime startup boundary:

1. npm installed multiple physical @php-wasm/universal copies, so runtime IDs created by @php-wasm/node were invisible to the WordPress wrapper.
2. The programmatic bootstrap replaced Playground's canonical auto-prepend file instead of composing with its preload chain.

Current main independently landed the stronger CLI-side file-level mount primitive while this branch was in flight. This branch was merged forward and retains that implementation; its remaining source change applies the same ownership boundary to the programmatic runner.

Verification

• clean npm ci
• npm run build
• npm run test:runtime-sources-playground-integration
• npx tsx tests/playground-cli-runner-bootstrap-ini.test.ts
• npm run test:playground-readonly-mounts
• npm run test:agent-task-contracts
• npm run test:native-agent-task-playground-e2e
• npm run test:runtime-services
• npm run test:runtime-services-lifecycle
• git diff --check

AI assistance

• AI assistance: Yes
• Tool: OpenCode
• Model: openai/gpt-5.6-sol
• Used for: diagnosis, implementation, merge resolution, and verification