Add Cloudflare Worker PHP-WASM and remote ZIP gates

[chubes4]

What?

Add an experimental Cloudflare Worker runtime gate for PHP-WASM and filtered remote ZIP ranges.

The Worker proves two independently addressable prerequisites for running WordPress under Cloudflare's 128 MB isolate limit:

• PHP 8.5 Asyncify boots and executes in a deployed Worker.
• decodeRemoteZip() traverses the current WordPress archive's 4,401 central-directory entries and emits only wp-includes/version.php through HTTP Range requests.
• Cloudflare invocation telemetry provides authoritative CPU and wall time while response correlation identifies cold and warm isolate execution.

Stack

This draft is stacked on #4110, which repairs generic filtered Range decoding. Once #4110 lands, its commits drop out of this diff.

Downstream consumer: Automattic/wp-codebox#1838

Remote evidence

Deployed Worker: https://playground-php-wasm-memory-gate.chubes.workers.dev

1. Request / and expect HTTP 200 with PHP 8.5.8 and marker cloudflare-php-wasm-memory-gate.
2. Request /?probe=remote-zip and expect HTTP 200 with marker cloudflare-remote-zip-range-gate, predicateEntries: 4401, predicateMatches: 1, and path wordpress/wp-includes/version.php.

Verified deployment version: 44c379ba-4d9a-42b8-94cb-c0ddc7140434. This deployment predates the latest telemetry correction; the telemetry workflow is documented and covered locally, but requires a separately authorized deployment for new remote evidence.

Testing Instructions

1. Run npx nx typecheck playground-cloudflare-worker-memory-gate.
2. Run npx nx test playground-cloudflare-worker-memory-gate.
3. Run npx nx lint playground-cloudflare-worker-memory-gate.
4. Run npm exec -- wrangler deploy --dry-run --config packages/playground/cloudflare-worker/wrangler.jsonc.
5. With an explicit Cloudflare account and deployment authorization, deploy the Worker, stream wrangler tail --format json, and correlate unique run query parameters with invocation CPUTimeMs and WallTimeMs.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Sol via OpenCode
• Used for: Cloudflare runtime investigation, implementation, workerd compatibility diagnosis, telemetry correction, regression testing, and evidence documentation in collaboration with Chris Huber.

[chubes4]

Stack verification after downstream integration:

• Stack head: de9c03aca08c7e02323e5f041e748473e406e8d2
• Node: v24.15.0
• npm exec -- nx run php-wasm-stream-compression:test: 8/8 passed
• npm exec -- nx run playground-cloudflare-worker-memory-gate:test: passed
• npm exec -- nx run playground-cloudflare-worker-memory-gate:typecheck: passed
• npm exec -- nx run playground-cloudflare-worker-memory-gate:lint: passed
• Add constrained primary runtime and explicit flush contract Automattic/markdown-database-integration#126 merged as f5a16c70eedec10aae42a412844ea520a62c02b3
• Run WordPress within Cloudflare Worker memory limits Automattic/wp-codebox#1872 merged as 3418cfac5505ec3380aa13d4b972e3a3f46c964d

The downstream disposable Worker proof restored canonical R2 state, advanced sequentially, serialized concurrent mutations, and reported sqlitePersisted: false. This stack remains the test/integration surface while #4110 goes through upstream review.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode and Homeboy
• Model: OpenAI GPT-5.6 Sol
• Used for: Stack verification, cross-repository integration, and evidence capture with Chris reviewing and owning the work.