Route REST URL imports through the canonical ability contract #837

Problem

PR #835 consolidated static-site-importer/import-url, but the importer block REST endpoint still resolves URL sources through website_artifact_from_url(). That legacy path performs one-shot caller-configurable collection, bypasses opaque import_id continuation, and still accepts provider / provider_args. The shipped reference client also treats one response as terminal.

This leaves the plugin UI and eventual WordPress.com-facing ability contract exercising different URL import implementations.

Direction

Make the resumable static-site-importer/import-url ability the only built-in URL collection and import path. REST is a transport projection of that envelope, and the reference client carries only the opaque continuation identity. URL preview must run against a disposable WordPress target that exposes the same ability; SSI should not retain a second server-side URL-to-artifact collector solely to build a browser Playground URL. Artifact, upload, pasted HTML, and provider-produced artifact previews remain artifact operations.

Acceptance criteria

• URL-only current-site REST requests invoke static-site-importer/import-url and return its continuation envelope unchanged.
• REST accepts import_id and the reference client repeats the same normalized intent until terminal completion.
• Public REST URL requests no longer accept provider, provider_args, work directories, collection mode, batch size, or runtime tuning.
• URL-only Playground preview requests return a structured requirement for a disposable ability-capable target rather than entering a legacy one-shot collector.
• The obsolete built-in website_artifact_from_url() one-shot collector is removed.
• Transport-level tests prove first call, opaque continuation, terminal completion, identity binding, and private-address rejection through the same ability path.
• Non-URL artifact/upload/Figma preview behavior remains covered.

Related: #832, PR #835.

AI assistance

OpenAI gpt-5.6-sol via OpenCode traced the duplicate REST and ability paths and drafted this issue. Chris Huber remains responsible for the issue and implementation.