Preserve commas inside srcset candidate URLs

## Problem

The PHP transformer splits `srcset` values on every comma. URLs may legally contain commas, including Wix image transform paths and data URLs, so the split produces fragments such as `h_25` that are later treated as unresolved local browser references. WordPress site-plan compilation then fails with `wordpress_site_plan_invalid_declaration`.

## Reproduction

Compile HTML containing:

```html

```

## Expected

Both complete URLs remain distinct candidates, their descriptors are preserved, and all srcset consumers use the same parsing behavior.

## Acceptance criteria

- URL-internal commas do not split candidates.
- Candidate-separator commas still split candidates.
- Data URL commas remain intact.
- Asset analysis, canonicalization, rewriting, and WordPress site-plan validation share one parser.
- Unit and site-plan contract coverage exercises the behavior.

## AI assistance

OpenAI GPT-5.6-sol was used through OpenCode to trace the failed site-plan reference to inconsistent `srcset` splitting, inspect the existing repair commit, and draft this issue. Chris Huber remains responsible for the report and proposed change.

Start with the PHP transformer’s current srcset splitting and trace how asset analysis, canonicalization, rewriting, and WordPress site-plan validation consume the candidates. Use the provided Wix and data URL reproductions, then add unit and site-plan contract coverage showing that URL-internal commas stay intact while candidate separators still split.

Written by the indexing model from the issue text.