Add two-tier PHP test harness (#1051)

[donnchawp]

This PR description was generated by AI.

Closes #1051.

Makes the procedural caching functions reachable from PHPUnit, split into two tiers by what they need to run. Both tiers run on PHPUnit 9.6 — see the version note below.

Smoke tier — CI, no database, no WordPress runtime

• tests/php/bootstrap-smoke.php loads the procedural caching files and provides a minimal, pure-PHP filter registry (add_filter / apply_filters / remove_all_filters) standing in for WordPress's hook system — enough to test WordPress-free functions and to inject filter input.
• New tests in tests/php/smoke/:
  • SupercacheFilenameTest — Restrict supercache filename to a safe character set #1050 filename-sanitization regression guard (hostile supercache_filename_str filter output is reduced to a single, separator-free path segment).
  • WpscRealpathTest — wpsc_get_realpath() + wpsc_is_in_cache_directory() path containment, against real temp dirs.
  • GetWpCacheKeyTest — cache-key composition.
  • WpscParseAcceptHeaderTest — moved in from tests/php/.
• phpunit.9.xml.dist targets the smoke bootstrap and tests/php/smoke.
• CI shape is unchanged: still composer test-php across PHP 8.2–8.5, no MySQL service.

Integration tier — local only, via make test-integration

• tests/php/bootstrap-integration.php loads the WordPress test library (wp-phpunit/wp-phpunit) and the procedural files under a real WP runtime + database. No apply_filters stub — WordPress core defines the real one.
• Runs inside the wp-env Docker environment. tests/php/wp-tests-config.php is environment-driven with wp-env defaults.
• phpunit-integration.9.xml.dist + an example WP_UnitTestCase test demonstrating the copyable pattern.

Why PHPUnit 9.6 for everything

WordPress's WP_UnitTestCase calls PHPUnit\Util\Test::parseTestMethodAnnotations(), removed in PHPUnit 10+, so the integration tier is capped at PHPUnit 9.6 (verified: PHPUnit 10.5 and 12.5 both fatal with the latest wp-phpunit 6.9.4). Since the integration tier can't move past 9.6 regardless, the whole project is pinned to PHPUnit 9.6 — one version, no isolated toolchain, matching the version WordPress core itself tests against. (An earlier revision of this PR ran the smoke tier on modern PHPUnit with a separate 9.x toolchain for integration; that split has been removed in favour of this simpler unified setup.)

Other

• Makefile: make test (smoke, no Docker) and make test-integration (auto-starts wp-env).
• .wp-env.json: dropped the deprecated testsEnvironment key; bumped phpVersion 8.1 → 8.3.
• tests/php/README.md documents how to add a test to each tier.

Verification

• composer test-php → OK (34 tests, 42 assertions) on PHP 8.5 / PHPUnit 9.6.
• make test-integration → OK (2 tests, 2 assertions) under real WordPress + database.
• composer lint → clean; php -l clean on all new files.

Out of scope (per the issue)

• Adding a database service to CI or running the integration tier in CI.
• The wp-cache.php file-move split (Refactor: split wp-cache.php into per-responsibility inc/ files (pure move, test-net first) #1061) and the config write-path module (Refactor: introduce a Config module to own the config-file write path #1062), which consume this harness.
• Broad coverage — this establishes the two tiers and a first batch.