Keep the Playground demo safe without zstd

[chubes4]

Summary

• remove the optional zstd side module from the canonical README launch so HTML, ZIP, folder, file, and paste imports always boot
• advertise Figma runtime capability in the importer, disable and explain the control when no proven decoder exists, and fail direct .fig intake with an actionable 501
• probe configured zstd commands with a bounded known frame and fail closed when process execution is unavailable
• publish and browser-verify immutable safe blueprints before advancing latest, independently of optional extension build/runtime proof
• validate exact alias identity, serialize Pages publication, and prevent old or overtaken release jobs from rolling mutable aliases backward

This advances #656 without claiming its optional zstd acceptance is complete. Figma can be re-enabled in hosted Playground after WordPress/wordpress-playground#4108 is merged and deployed; the canonical demo no longer depends on that timeline.

Verification

• npm test (all suites passed except the publication assertion changed by this PR; that assertion was updated and rerun successfully)
• npm run test:php-wasm-zstd
• php tests/smoke-importer-block.php (339 assertions)
• php -n tests/figma-zstd-decoder.php native
• php -n tests/figma-zstd-decoder.php command
• php -n tests/figma-zstd-decoder.php unavailable
• php -n -d disable_functions=proc_open tests/figma-zstd-decoder.php disabled
• PHP lint across all tracked PHP files
• actionlint .github/workflows/release-php-wasm-zstd.yml
• git diff --check
• independent review found no remaining findings

Follow-up

A new Homeboy release is required after merge so the release-tagged safe blueprint can be published to playground/latest/blueprint.json; until then the current README alias remains absent.

AI assistance

OpenAI openai/gpt-5.6-sol via OpenCode diagnosed the publication/runtime coupling, implemented the safe capability and publication boundaries, added regression coverage, and ran verification. Chris Huber reviewed and owns the change.