Introduces a 3-phase automated review system (triage → batch → synthesis) that
reviews plugin submissions against directory guidelines, security checklists,
and code quality standards using the WordPress AI Client API.

- New `Plugin_Automated_Review` job class with cron and AJAX entry points
- Bundled prompt references: security checklist, guidelines, 13 micro-prompts
  encoding experienced reviewer judgment rules
- Integrates with existing Plugin Check (PCP) results for cross-referencing
- Falls back to bundled guidelines when DevHub is unreachable
- Enforces verdict consistency (blockers always mean reject)
- Admin UI button gated to review-eligible statuses with proper nonce/cap checks
- WPCS formatting cleanup in class-review-tools.php (short → long array syntax)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Pass slug args to wp_next_scheduled() so duplicate detection works
- Check wp_supports_ai() in cron_trigger() and async AJAX path
- Cast file_get_contents() returns to string to avoid TypeError with strict_types
- Wrap AI client call in try/finally to ensure timeout filter is always removed

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Escape file paths in XML tag attributes with esc_attr()
- Add untrusted-content warning to triage system prompt
- Cast batch-prompt.md file_get_contents to string for strict_types safety

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Use end() for ZIP attachment selection instead of max(array_keys())
  for more reliable "newest attachment" semantics
- Include vendor/node_modules paths in all_files list (still excluded
  from source_files) so structure analysis can detect dev artifacts
- Pass full file list to batch prompts for disallowed-file detection
- Rewrite synthesis prompt to request JSON output matching the schema,
  fixing mismatch with as_json_response() that could force fallback path
- Restore leading backslash on use import to match file convention

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…tches

- Inject incomplete-coverage warning in run_review() before
  determine_verdict(), covering both AI synthesis and fallback paths
- Remove duplicate incomplete-coverage logic from build_fallback_result()
- Cast guidelines fallback file_get_contents to (string)
- Fix batch prompt: replace per-guideline PASS/FAIL/WARN/N/A instruction
  with "only create findings for violations" to match JSON schema
- Mark common-issues section as internal reference only to prevent
  fix suggestions from leaking into findings output

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

39 tests covering the deterministic logic methods:
- determine_verdict(): blockers→reject, warnings→needs_changes, clean→approve
- build_fallback_result(): severity bucketing, field defaults, multi-batch
  aggregation, unknown severity routing
- normalize_file_priorities(): array-of-objects and map form handling
- build_default_triage(): extension-based priority, PCP error promotion
- build_batches(): skip filtering, oversized isolation, priority sorting,
  batch size splitting
- collect_files(): vendor/node_modules skipping, extension filtering
- summarize_pcp_results(): error/warning counting, formatted output
- format_as_note(): verdict display, HTML output, finding rendering
- format_pcp_for_file(): forward and reverse path matching
- find_readme_content(): regex matching

Pure-logic methods made public for direct testability. Uses Yoast
PHPUnit Polyfills XTestCase for PHPUnit 10 compatibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Catch missing or invalid attachment file paths early with an explicit
check, rather than relying on Filesystem::unzip() to fail gracefully.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>