Media: Stop the shell breaking core's uploader button and grid refresh

[mmtr]

Two Media Library bugs, both from shell plumbing leaking into a core screen.

Proposed Changes

• The chromeless bridge's link interceptor now skips anchors carrying core's aria-button-if-js class. Fixes Add Media File opening a redundant window on top of core's inline uploader, and restores the comment row actions and the plugin auto-update toggle, which broke the same way.
• Links with that class but no owning script (the Media list table's Trash / Restore / Delete Permanently) get _wp_http_referer stamped on the href before the interceptor yields.
• openstation_chromeless is stripped from the query vars upload.php hands the media grid. Fixes the grid not showing an upload until the window is reopened.
• New vitest harness that runs the emitted interceptor against a fixture DOM.

Incidentally fixes cancelling the "are you sure" confirm on Delete Permanently. The interceptor used to preventDefault in capture and hand the URL to the shell before the inline onclick ran, so cancelling still deleted the file.

Why are these changes being made?

aria-button-if-js is core's marker for "this anchor is an in-page button, the href is only the no-JS fallback". Our interceptor is capture-phase, so it beat the script that owns the button and gave the user the fallback URL instead of the action they clicked. Skipping on the class covers every surface with that shape rather than just this one button.

The class doesn't promise a handler, though. The Media list table stamps it and binds nothing, so those hrefs really are the navigation, and the parent used to add _wp_http_referer to them on its destructive-action path. Yielding loses that, and under a Referrer-Policy of strict-origin or tighter post.php then sees a bare origin, matches neither post.php nor post-new.php, and redirects the window to the site front page. Stamping it in the iframe is simpler than the parent round trip: the source page is just window.location.

The interceptor is JS emitted from a PHP heredoc, so the PHP suite can only assert that source strings appear in the right order. Both bugs of this shape got through that, hence the DOM-level harness.

upload.php copies unknown $_GET keys into _wpMediaGridSettings.queryVars, and wp.media.model.Query only watches the upload queue when every query arg is one it can filter on. Our flag riding along was enough to stop the grid from ever seeing a finished upload. Core has no filter on that array, so the shim re-localizes the settings with the key removed.

Testing Instructions

Media grid, both fixes:

1. Enable OpenStation and open the Media window in grid view.
2. Click Add Media File. Make sure only the inline uploader expands. No second window opens.
3. Click Select Files and pick an image. Make sure the new item appears in the grid as soon as the upload finishes, without reopening the window.
4. Click Add Media File again. Make sure the uploader collapses.

On trunk, step 2 also opens an Add Media File window (closing it leaves the drop zone stranded above the grid), and step 3 uploads the file but never shows it.

Media list table, where core stamps the class but binds no handler:

1. Switch the Media window to list view (upload.php?mode=list).
2. Hover a row, click Delete Permanently (or Trash if MEDIA_TRASH is on), then cancel the confirm. Make sure the file is still there.
3. Click it again and confirm this time.
4. Make sure the window lands back on the media list with the "Media file permanently deleted" notice, still chromeless, in the same window. No new window, no admin sidebar in the iframe.
5. Worth repeating step 3 with a stricter referrer policy, since the default one hides the failure. Drop a mu-plugin that sends Referrer-Policy: strict-origin on admin responses, then check the window still lands on the media list rather than the site front page.

Comment row actions:

1. Leave a comment on any post, open the Comments window.
2. Hover the row and click Unapprove. Make sure the row turns yellow and Pending goes up in place, with no reload and no new window.

Plugin auto-update toggle:

1. Open the Plugins window and click Enable auto-updates on any plugin.
2. Make sure the link flips to Disable auto-updates in place, with no reload and no new window.

Regression check on the existing skip list:

1. Open the Plugins window, go to Add New Plugin, click Install Now on any plugin.
2. Make sure it installs in place with the inline progress label, not by opening a window on update.php.