[Audit][Quality] Add runtime and security regression gates

## Context

The repository lacks automated gates for the failure classes identified by the runtime audit.

## Scope

- Add PHP syntax checks and WordPress coding-standard checks for custom code.
- Detect configuration-dependent short tags and unsafe direct superglobal output.
- Add smoke or integration coverage for authentication, password reset, LearnDash completion, certificates, and malformed optional metadata.
- Add JavaScript and local asset-reference checks.

## Done when

- CI blocks parse errors, short-tag regressions, broken local assets, and lint failures.
- Critical account and LearnDash journeys have repeatable regression coverage.
- Checks run against the supported PHP and WordPress versions.