ci: cover theme checks and bound reusable excerpts

[brianvarskonst]

Adds pull-request and main-branch CI for the starter theme: canonical composer qa on PHP 8.5, translation catalog verification, production build and token consistency, Chromium lazy-chunk checks on nested routes, dependency audits and shared workflow linting.

Documents that explicit template candidates still pass through the theme filter, core template callbacks can run again during Twig fallback selection, and asset symlinks must resolve inside build/. Caps reusable-block expansion at 100 references per excerpt; native WordPress tests verify wide inputs and reset between calls.

M1 from Review 3 was already committed as 25aa8a5 and merged through PR #1. Full WordPress fixture/browser checks remain separate from this package CI. The public Encore array API requested by S-2 is prepared in SymPress/assets#5 and has passed its local and GitHub QA; this PR keeps the existing stable Composer dependency until the new API is released.

Local validation: Composer QA (14 tests/41 assertions plus 48 template assertions), build, chunks, translation check, 31 native WordPress regression checks and 11 browser tests pass. WordPress and browser suites were run sequentially because both use the same disposable database. See docs/review-3-2026-10-01.md.

[brianvarskonst]

Standards

No actionable violations of the theme's documented rules or code-smell findings. The excerpt counter remains local to each call; existing content protection and filter cleanup are preserved. CI clearly separates package checks from WordPress/browser integration.

Spec

No blocking findings. Required PR checks cover canonical Composer QA, catalog freshness, the production build and a real Chromium lazy-chunk test. The total reusable-block budget is shared across sibling/nested references and resets between excerpts. The requested behavior and symlink/filter caveats are documented.

S2's downstream adoption remains explicitly pending a stable Assets release. This PR does not claim that the theme has already removed the protected-method adapter.

Verification

Re-ran Composer QA on the reviewed head: 14 PHPUnit tests / 41 assertions, 48 template assertions, PHPStan, PHPCS and syntax/Twig checks pass. Catalog check and all 31 native WordPress regression checks pass. The same runtime code passed all 11 browser tests during implementation; later changes only adjust CI runner/browser setup.

Review totals: Standards 0 findings; Spec 0 blockers, 1 documented follow-up (public Assets API adoption).