CI: activate protected WordPress validation and release pipeline

[ProxiwebLabs]

Scope

• pin every third-party action to a reviewed immutable SHA
• add fail-closed secret/sensitive-file and whitespace gates
• validate PHP 7.4–8.3, WordPress and WooCommerce compatibility
• build tracked-only release artifacts with checksums and a manifest
• require tag/plugin/stable-tag version consistency
• attach tag releases to the protected wordpress-release environment
• refuse replacement of an existing release or immutable artifacts

Local evidence

• workflow YAML parsing: PASS
• plugin/build PHP syntax: PASS
• PHPUnit: 4 tests, 16 assertions
• deliberate tag/version mismatch exits 65
• secret scan: 64 versionable files, PASS
• tracked-only package rehearsal and manifest verification: PASS
• git diff --check: PASS

Safety

This PR does not deploy WordPress or ZipQuantum production. Release remains tag-triggered and gated by the wordpress-release environment.

[ZipQuantumHQ]

CI matrix is green across security, quality, PHP syntax, WordPress, WooCommerce and forward-compatibility. Approval is for merge only; no release tag or production deployment is authorized.