False positive `missing_direct_file_access_protection` for class files containing `require_once`

Description

PHP files that contain only a class definition and require_once statements (to load parent/dependency classes) are incorrectly flagged with missing_direct_file_access_protection. These files have no top-level executable code and are genuinely safe for direct access, so the error is a false positive.

Steps to reproduce

Create a PHP file in a plugin with only a require_once statement and a class definition:

<?php
require_once __DIR__ . '/class-parent.php';

class My_Class extends Parent_Class {
    // ...
}

Run wp plugin check <slug> — the file is flagged with missing_direct_file_access_protection.

Expected behaviour

No error. The file contains no executable code and is safe for direct access.

Actual behaviour

missing_direct_file_access_protection error is reported at line 0.

Disclaimer: Claude was used to investigate this and write the issue. I verified its outputs.

Reproduce the issue with the PHP example in a plugin and run wp plugin check <slug>. Start at the implementation of missing_direct_file_access_protection, then verify that class-only files with require_once are not reported while files with top-level executable code remain covered. Done means the false positive is gone and regression coverage protects both cases.