Add WordPress adversarial adapter and vulnerable runtime campaigns

## Problem

The generic #2014 contracts deliberately do not embed WordPress grammars, policies, hooks, or transport special cases. A WordPress extension adapter is still required to turn them into end-to-end security and correctness campaigns inside disposable WP Codebox runtimes.

## Scope

- Register WordPress-owned mutators for REST, AJAX, XML-RPC, blocks, shortcodes, serialized values, options/meta, files, cron, CLI, roles/capabilities, and multisite membership.
- Register generic-oracle adapters for authorization/nonce/tenant isolation, injection/execution indicators, transactional consistency, duplicate effects, fail-open behavior, filesystem escape, and secret leakage.
- Intercept WordPress HTTP transports using the generic transport-fault model and publish exact/emulated/unsupported fidelity.
- Add faithful PHP/WordPress and cron clock controls; report database clock support independently.
- Emit bounded hook, route, query, filesystem, cache, lock, memory, CPU, and duration novelty signals.
- Add intentionally vulnerable neutral plugin and theme fixtures for authorization, injection, state corruption, true races, external-service failure, and UI-state defects.
- Run disposable integration/E2E campaigns that automatically discover and minimize every fixture defect and replay stable findings.

## Acceptance criteria

- Fixtures run only inside disposable runtimes with network denied by default.
- Campaigns prove deterministic concurrent replay, service failure/recovery, minimized browser journeys, and stable fingerprints.
- Every finding has a sealed, redacted replay bundle with exact runtime/component provenance.
- No WordPress-specific name or policy enters runtime-core.

Refs #2014

首先阅读 #2014 中引用的通用契约，并将列出的 WordPress 表面、oracle 适配器、传输故障、时钟、信号和 fixtures 映射到请求的适配器范围。完成的标准是：网络访问被拒绝的一次性 campaign 覆盖验收标准，包括确定性重放、最小化 journey、稳定指纹，以及已封存并经过删改的 provenance bundle，同时 runtime-core 中不包含 WordPress 特定的 policy。

由索引模型根据 Issue 内容生成。