Summary
- Fix plugin-update-safe for WordPress.org plugins: use the same \update_plugins\ transient package URL as wp-admin and list-plugins, instead of fetching the full versions map from plugins_api.
- Fallback chain: transient package → plugins_api downloadlink → constructed downloads.wordpress.org URL for explicit target_version.
Test plan
- list-plugins shows update_available for a .org plugin
- plugin-update-safe with slug only runs Plugin_Upgrader::upgrade successfully
- plugin-update-safe with target_version installs that version