Add first-class Plugin Check sandbox command

[chubes4]

Summary

Add a first-class WP Codebox command for running the official WordPress Plugin Check inside a disposable Playground sandbox.

Why

WP Codebox is being productized as a WordPress development sandbox. Plugin Check is a canonical WordPress validation workload and should be discoverable as a stable sandbox capability instead of requiring every caller to hand-roll wordpress.wp-cli recipes.

Proposed command

wp-codebox run \
  --mount ./my-plugin:/wordpress/wp-content/plugins/my-plugin \
  --command wordpress.plugin-check \
  --arg plugin-slug=my-plugin \
  --artifacts ./artifacts \
  --json

Scope

• Register wordpress.plugin-check in wp-codebox commands --json.
• Mount/load the target plugin from /wordpress/wp-content/plugins/<slug>.
• Ensure the official Plugin Check plugin is installed or loaded inside the sandbox runtime.
• Run Plugin Check with machine-readable output, preferably strict JSON when available.
• Normalize findings into a stable WP Codebox artifact shape.
• Capture raw Plugin Check output and normalized findings in the artifact bundle.
• Add smoke coverage for the command and artifact shape.

Non-goals

• WordPress.org login or submission.
• Plugin packaging policy.
• SVN release workflows.
• Replacing Pressship or Homeboy release orchestration.

Acceptance criteria

• wp-codebox commands --json includes wordpress.plugin-check.
• A simple plugin mounted into Playground can run the command successfully.
• JSON output includes command, target plugin, exit code/status, summary counts, and findings.
• Artifact bundle includes raw and normalized Plugin Check output.
• Existing npm run check remains green or the new targeted smoke is documented if full check is too expensive locally.

[chubes4]

Blocked on runtime viability.

I tried taking over the implementation in /Users/chubes/Developer/wp-codebox@issue-167-plugin-check. The narrow command/catalog/normalization wiring can build, and targeted non-runtime smoke coverage passes:

npm run build && npm run discovery-command-smoke && npm run plugin-check-normalization-smoke

However, executing the official Plugin Check path inside Playground is not currently reliable:

• Full wordpress.plugin-check run against examples/simple-plugin was aborted after producing no useful output.
• Targeted checks=plugin_header_fields run failed inside PHP-WASM with RuntimeError: unreachable and timed out after 120s.
• A raw WP-CLI probe could not be completed through the current run CLI because run does not accept --blueprint; the first-class command path installs Plugin Check via the runtime blueprint and then hits the PHP-WASM crash when invoking the checker.

Because WP Codebox should not ship a first-class validation command that only proves normalization/catalog wiring while the real official checker crashes, this should pause until we isolate whether the issue is:

1. Plugin Check using APIs unsupported/unstable in Playground PHP-WASM.
2. The way WP Codebox installs/activates Plugin Check via blueprint.
3. The direct PHP CLI_Runner invocation vs the actual WP-CLI command path.

Current local worktree has uncommitted exploratory changes in wp-codebox@issue-167-plugin-check; no PR opened.

[chubes4]

PR #171 now includes the runtime fix for the Playground/Plugin Check crash: #171

Root cause confirmed: Plugin Check installs and wp plugin check --help works, but actual checks hit Playground Asyncify's RuntimeError: unreachable path because PHPCS uses proc_open(). WP Codebox now respawns runtime CLI commands under Node JSPI flags on Node 23+ and runs the official wp plugin check command instead of calling Plugin Check internals directly.

Verification passed: npm run check, plus targeted and full first-class wordpress.plugin-check runs against examples/simple-plugin.