Snapshot Core 2.0.0

Snapshot Core is now a WordPress plugin, released from
snapshotinteractive/wp-snapshot-core
and updated from the Plugins screen. This is a major release: the theme changes below are
required.

• Plugin: snapshot-core.php with a plugin header and Update URI, so every installed
  copy gets Update now and auto-updates from the public GitHub releases. Each copy only
  offers versions within its own major (updates/<major>.json) and links to the upgrade
  notes when a new major is out. SNAPSHOT_CORE_UPDATES false turns the check off.
• Licence: GPL-2.0-or-later, without warranty. Updates are free for every site.
• Bundled libraries (bacon-qr-code, zxcvbn-php, WebAuthn, otphp and their dependencies)
  are prefixed under Snapshot\Vendor\, so they never clash with another plugin's copy.
  Acorn now comes from the theme and is no longer a requirement of the package.
• Assets: the admin, sign in and editor CSS and JS are built with the plugin (build/)
  instead of by the theme's Vite. The theme's tokens.css still brands them: its @theme
  values are printed as CSS variables after the plugin's styles (filter
  snap/core/tokens_path). Core::assets() and Core::asset() replace
  Vite::withEntryPoints(Core::entries(...)); Core::base(), entry() and entries()
  are gone, and Core::path() and Core::url() now resolve inside the plugin.
• The block page (security/blocked) loads its stylesheet from the plugin; it pointed at
  an entry the theme never built.
• File integrity: the release zip carries its own security-manifest.json, and the scan
  checks the plugin against it (plugin.modified, plugin.unknown) instead of asking
  WordPress.org. Plugins whose Update URI points elsewhere are no longer looked up on
  WordPress.org at all.
• Snapshot → Status shows the plugin version from its header and a snapshot-core assets
  check.
• Admin notices when the plugin is active but the theme does not load it, or when the
  plugin was installed from source without its built files.

Upgrading a site from 1.x

1. Install the 2.0.0 release zip under Plugins and activate it. The 1.x theme keeps
   working on it in the meantime.
2. In the theme's composer.json, remove the snapshotinteractive/snapshot-core
   requirement and its repository entry, then composer update snapshotinteractive/snapshot-core.
3. functions.php: wrap Core::load(...) and Core::boot() in class_exists(Core::class),
   as in the starter, so the site renders if the plugin is ever off.
4. vite.config.js: remove the vite.mjs import, ...core.entries, ...core.alias and
   preserveSymlinks.
5. bin/acf-check.php, bin/seed-check.php, bin/blade-check.php: read the package
   through bin/core-path.php, as in the starter.
6. Remove any Dependabot or CI configuration that installed the 1.x package.