feat(runtime): native custom WordPress roots and full browser-action contract

[chubes4]

Closes #2478.

Summary

Closes two gaps in the wordpress-native backend generically (no consumer- or product-specific names):

1. Custom WordPress root

runtime.assets.wordpressDirectory was already resolved by the CLI and honored by Playground, but the native Docker driver ignored it and always ran stock WordPress from its pinned image. The driver now copies the supplied WordPress directory into the contained runtime before install and readiness checks, keeps the pinned image PHP/Apache/OPcache/two-worker behavior, preserves wp-config and database wiring, and records the mounted source (wordPressRoot.source: "directory" + path) in native provenance so evidence can never be confused with the image default.

2. Full browser-action argument contract

wordpress.browser-actions on native now honors:

• route-host — declared hosts are mapped into the contained runtime (rewritten to the preview origin with host/x-forwarded-* headers) so host-dependent routing behaves as on Playground.
• auth-user-id — authenticates as the requested fixture user using only runtime-generated fixture credentials (never caller/ambient credentials); non-fixture user ids fail closed.
• capture — honors steps, console, errors, network, screenshot, html; unsupported tokens fail closed with an actionable error.
• step-timeout — bounds each step as a typed NativeBrowserActionTimeoutError.
• timeout — bounds the whole action as a typed NativeBrowserActionTimeoutError.
• Unsupported argument values fail closed with actionable errors rather than silently degrading, and timeouts retain captured artifacts.

Testing

• npm ci
• npm run build — pass
• npm run test:native-runtime — pass
• git diff --check — clean

Added deterministic fake-driver unit coverage in tests/native-runtime.test.ts (custom-root copy ordering + provenance, and fail-closed browser-argument validation), and extended tests/native-docker-runtime.integration.test.ts to prove a custom WordPress root and the full argument set under real Docker, skipping explicitly when Docker is unavailable.

Honest note: Docker is NOT available on the machine where this was implemented/verified, so the live native-docker-runtime.integration.test.ts lane skipped (reason: trusted-containment-tools-unavailable). It was not run and is not claimed to have passed. The custom WordPress root and full browser-argument behavior require live Docker verification.

Non-goals honored

No consumer-specific paths, fixtures, or product names were added to runtime-core or the native package.

---

AI assistance: OpenCode with big-pickle was used to implement native custom WordPress roots and the full browser-action contract, and to run verification.

[chubes4]

Live Docker verification (completed after the PR description was written)

The PR body notes local Docker was unavailable. This has now been verified on a Docker-capable runner at ae465e6e.

npm run test:native-docker-runtime passed (runs wp-codebox-2478-native-live-ae465e6e and wp-codebox-2478-native-evidence).

Proven behavior, not shape assertions:

• Custom WordPress root — a distinct root containing a unique marker file was supplied through assets.wordpressDirectory; provenance recorded { source: "directory", path }, and wordpress.run-php confirmed the marker resolves inside the container. A consumer distribution can no longer be silently replaced by the image default.
• Full browser-action contract — auth-user-id=1, route-host=example.test,site.test, capture, step-timeout=30s, and timeout executed together; all 4 browser steps passed and a declared route host resolved inside the contained runtime.
• Evidence retained — steps, network, console, errors, and command artifacts captured; benchmark reported coldStartupMs: 3841, warmNoopPhpMs: 43, dynamicWordPressRequestMs: 31.

AI assistance: OpenCode with big-pickle implemented the change; Claude Code with claude-sonnet-4-5 ran and verified the live containerized execution and captured this evidence.