Publish a surface-neutral client for Cloudflare WordPress provisioning

Parent: #1970

## Goal

Make the same provisioning contract easy to call from WP Build, Studio, CLI, Agents API, ChatGPT, CI, and plain HTTP without embedding product behavior in the Cloudflare runtime.

## Scope

- versioned TypeScript client over artifact staging, create, polling, imports, claims, renewal, and deletion
- streaming digest computation and bounded artifact upload
- idempotency-key generation/persistence supplied explicitly by the caller boundary
- typed operation progress, retry, terminal receipt, and error schemas
- CLI commands and a generic WordPress Ability/Agents API projection using the same client contract
- portable examples for service accounts and interactive callers
- webhook/event adapter contract only after durable queue identities exist

## Acceptance criteria

- Every supported surface uses the same public HTTP schemas and immutable artifact bytes.
- Clients never require direct R2, D1, Cloudflare account, or Worker deployment access.
- Retry after timeout converges through the original idempotency key.
- A caller can resume polling from persisted site/operation URLs after process restart.
- Secrets are injected by the surrounding surface and never written to artifacts, logs, or receipts.
- Contract tests run one fixture through raw HTTP, TypeScript client, CLI, and Ability projection and compare receipts byte-for-byte where ordering is canonical.
- WP Build and Studio producer outputs remain adapter-neutral.

## Related

- #1974 producer interoperability proof

## AI assistance

OpenAI GPT-5.6 Sol via OpenCode separated the universal HTTP contract from surface adapters and drafted this client slice with Chris Huber.

Start with parent issue #1970 and the related producer interoperability proof in #1974, then trace the raw HTTP contract described here. Compare the TypeScript client, CLI, Ability projection, and contract-test entry points once they exist; done means one fixture produces matching canonical receipts across all supported surfaces without direct infrastructure access.

Written by the indexing model from the issue text.