WP Origin: round-trip contract tests and plugin hardening

[adamziel]

Implements Milestone 1 from the WP Origin PRD: byte-exact round-trip contract tests for the Markdown component, plus a batch of stability fixes to the plugin itself.

Round-trip tests — 29 cases covering both directions:

• md -> wp -> md: Markdown goes through WordPress and must come back byte-for-byte. Covers paragraphs, headings, lists, tables, blockquotes, images, links, gutenberg fences (opaque unsupported-block preservation), front matter, and mixed content.
• wp -> md -> wp: Block markup is exported to Markdown and pushed back; the resulting blocks must match (modulo whitespace inside block comment delimiters, which WordPress normalises on save).
• One-way alias: the legacy block fence language is still accepted on import but always exported as gutenberg.

Plugin hardening:

• Repository now lives in a per-request temp directory and is cleaned up in a finally block, removing the persistent uploads-dir repository that would cause state leaks between requests.
• Binary Git responses bypass the WordPress REST JSON encoder via a rest_pre_serve_request hook — without this, pack data gets double-encoded and breaks git clone.
• Permission checks now cover both editing existing posts and creating new ones via explicit assert_can_edit_post and assert_can_create_post_type helpers.
• Metadata values are correctly wrapped as array('value') as BlocksWithMetadata requires; the previous code passed scalars and would have thrown on every export.
• Slug consistency is validated on push: a file at post/hello-world.md whose front matter says slug: something-else is rejected.