Fix PHPUnit cache writes through readonly mounts

[chubes4]

Closes #1803

Summary

• Allocate a unique private PHPUnit result-cache file inside the sandbox under /tmp for every WP Codebox PHPUnit invocation.
• Fail closed when private-cache permissions cannot be set to and verified as 0600 on POSIX filesystems.
• Add a locked Composer PHPUnit 9/wp-phpunit harness and a real readonly-source Playground integration.

How to test

1. Run npm ci && npm run build.
2. Run npm run test:playground-phpunit-readonly-cache-integration. The test copies the committed tests/fixtures/phpunit-playground-harness manifest and lockfile to a temporary directory, runs composer install --no-interaction --prefer-dist, then executes the built CLI through a real wordpress.phpunit recipe.
3. Run npx tsx tests/phpunit-project-autoload.test.ts && npm run test:playground-readonly-mounts && npm run test:playground-readonly-mounts-integration.
4. Run the downstream WordPress PHPUnit canary from a fresh Homeboy Extensions checkout: HOMEBOY_WP_CODEBOX_INSTALL_DIR=/var/empty/wp-codebox HOMEBOY_WP_CODEBOX_BIN=/path/to/wp-codebox/packages/cli/dist/index.js HOMEBOY_WP_CODEBOX_CORE_MODULE=/path/to/wp-codebox/packages/runtime-core/dist/recipe-builders.js bash wordpress/scripts/test/playground-db-activation-smoke.sh.

Dependency and network note

The integration requires Composer and network access to install the committed lockfile into a temporary directory. It does not vendor Composer dependencies; normal Composer cache reuse applies. The GitHub workflow installs PHP 8.2/Composer and runs this integration.

Verification

The in-repository integration ran PHPUnit 9.6.34 with wp-phpunit 6.9.4 in actual Playground against a readonly temporary plugin containing a binary sentinel. It asserted run_tests diagnostics, no host .phpunit.result.cache, and an unchanged source-tree digest. The downstream canary also passed 3 tests and 7 assertions with an unchanged readonly fixture archive hash.

Compatibility

No public API change. WP Codebox does not accept caller-provided PHPUnit result-cache paths. Cache state is internal, per-run, sandbox-private, and cleaned up at PHP shutdown; plugin source mounts remain free of implicit cache writes. Explicit readwrite mount write-back behavior is unchanged.

Dependency and context

This complements #1804 and closes #1803. It validates the real downstream WordPress PHPUnit boundary exercised by Extra-Chill/homeboy-extensions#2257.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode/openai-gpt-5.6-sol
• Used for: Diagnosed the Playground/PHPUnit cache path, implemented internal cache isolation, and added locked real-runtime regression coverage. Chris reviews and owns the change.