[sarthak-19]

What

Adds 6 execution tests for #13 in the existing comments-users category. wp-core-v1 goes from 350 to 356 (core plus CLI: 383). Dataset and pinned-count changes only; no harness or runtime changes.

ID	Behavior measured	Main discriminator
e-comments-users-008	Member directory: role__in, meta filter, numeric points ranking, three per page with the full total	role with an array means every role; meta_value puts '9' above '300'; a page-sized total is wrong
e-comments-users-009	Find users by a fragment of their display name	No * wildcards means exact match; without search_columns the login and email also match
e-comments-users-010	Follow/unfollow topics stored as one user meta row each	update_user_meta overwrites every row; a unique add refuses the second topic; a value-less delete wipes all; untouched rows keep their meta IDs
e-comments-users-011	Profile edit: display name and website on the user record, first name and phone as meta	update_user_meta( 'display_name' ) writes stray meta and leaves the column alone; meta writes for a missing user leave orphaned rows
e-comments-users-012	Email-change history on profile_update	Inside the hook get_userdata() already has the new address; non-email updates must not log
e-comments-users-013	Custom profile field on both profile screens, saved from both save hooks	No edit_user check lets a subscriber edit other accounts; edit_users blocks a user's own profile; output must be escaped

Why

Issue #13 predates most user coverage. 31 user-related tests already exist: roles and caps (e-roles-caps-*), login and registration hooks (e-auth-*), basic user create/meta (e-comments-users-001, 002, 006) and WP-CLI user workflows (e-cli-users-*). This PR covers what's still missing: complex user queries, multi-value user meta, user-table fields vs meta, the profile update lifecycle, and custom profile fields. The "Knowledge Tests" section can't be implemented, since that track was removed in #48.

Points for review

1. Release contract (feat: define one public benchmark release contract #78). feat: define one public benchmark release contract #78 makes any dataset change a new benchmark version. Happy to hold this until feat: define one public benchmark release contract #78 lands and then rebase onto wp-core, or land first, whichever you prefer.
2. Category. I added the tests to comments-users rather than a new users category, so the category mapping doesn't change. I can split them out if you'd rather have a separate category.
3. Counts. feat: add performance and caching execution tests (cache-aside, invalidation, N+1, batching) #72 (performance tests) also bumps README.md, test_execution_dataset.py and test_wp_cli_shell.py. Whichever merges second needs a one-line rebase.
4. 013 fixture. Core's send_confirmation_on_profile_email() reads $_POST['email'] on personal_options_update. Like the real profile form, the fixture submits the target user's unchanged email. It also carries a valid update-user_<id> nonce, so solutions that call check_admin_referer() still pass.

Verification

• ruff check python: passed
• mypy python: no issues
• pytest python -q: 288 passed, 71 skipped
• wp-bench run --check-reference-solution (all 356 core tests, 6 workers, SQLite runtime on WordPress 7.1): 356/356 passed
• wp-bench run --check-exploits --test-id <6 new tests> on reset_per_test: 0/6 exploitable
• Each authored exploit (20 in total) was run through the verifier directly and fails the specific assertion it targets
• Alternative correct solutions also pass:
  • meta_value_num with offset
  • escaped $wpdb LIKE
  • get_users() with fields => 'ids'
  • wp_update_user() with meta_input
  • the send_email_change_email filter
  • a class-based profile field that also calls check_admin_referer()
• python datasets/export_dataset.py: 383 rows (356 core + 27 CLI)
• git diff --check: clean

Commits are split by area: query and meta tests first (350 to 353), then lifecycle and profile tests (353 to 356). Each commit passes the dataset tests on its own.

Refs #13