Run the Abilities API in the runtime-matrix smoke test (Phase A3)

[dknauss]

Summary

Phase A, ticket 3 of docs/planning/refactor-and-standards-memo.md.

Until now, no ability had ever run on a real WordPress install. The PHPUnit mocks only cover registration and wiring. This PR adds scripts/runtime-matrix/check-abilities.php, which smoke.sh runs through wp eval-file … --user=admin, the same way check-blocks.php and format-styles.php run.

What it checks:

• borges/get-bibliographies returns the smoke post's bibliography with entries.
• A borges/add-citations dry run with one CSL book:
  • returns dryRun: true and an etag;
  • reports entryCount up by exactly one;
  • leaves post_content byte-identical.

Gating. On WordPress without the Abilities API (6.4–6.8, such as the apache-php74-wp64 cell), the script prints abilities-skip and the smoke test carries on. The wplatest cells run it.

Why PHP, not REST. The abilities run in PHP through wp_get_ability()->execute(), not through core's /wp-abilities/v1 REST controller. That still exercises the real permission callbacks (edit_post as admin), input-schema validation, and the dry-run and ETag logic. Testing the REST exposure would be a small follow-up if wanted.

The write abilities register because the earlier part of the smoke test already installs the mu-plugin that enables the write routes.

Validation

• bash -n scripts/runtime-matrix/smoke.sh: passes. php -l on the new file: passes.
• composer test:php: 446 tests pass.
• I checked the /smoke mount (scripts/runtime-matrix:/smoke:ro) and the admin user (created with --admin_user=admin in every install path) against smoke.sh.
• First real run: this PR's runtime-matrix wplatest cells. The check has not run against real WordPress before.

Checklist

• No plugin code changed
• CLAUDE.md CI overview updated

🤖 Generated with Claude Code

https://claude.ai/code/session_01KbVuMPN7YTcV27vwsG3LZ2

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.28%. Comparing base (4d638a2) to head (bf49659).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #152   +/-   ##
=========================================
  Coverage     88.28%   88.28%           
  Complexity       22       22           
=========================================
  Files            61       61           
  Lines          7290     7290           
  Branches        690      690           
=========================================
  Hits           6436     6436           
  Misses          291      291           
  Partials        563      563           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.