Classify URL collection scripts

[chubes4]

Fixes #813

Summary

• Default URL site collection to a frozen static artifact script policy.
• Omit inline and external script tags before asset admission, recording deterministic reason-coded provenance with type, hash, and external URL where applicable.
• Keep client-rendered shell detection ahead of script omission.
• Add include_scripts=true and CLI --retain-scripts for full legacy retention; include_scripts=false remains explicit complete omission.

Evidence

The deterministic Wix-like fixture contains two external application assets (4,000 and 6,000 bytes), an inline hydration candidate, and a data script. Static collection makes 2 asset requests rather than 4 and reduces retained bytes by more than 10,000 while preserving the server-rendered heading, body, stylesheet, and image references. The resulting artifact compiles with dynamic_client_assets.status=proven and no site-plan diagnostics.

Verification

• php tests/smoke-url-site-collector.php
• php tests/smoke-url-batch-import.php
• php tests/smoke-url-import-runtime.php
• npm test -- --all (44 passed, 0 failed; 10 environment-gated tests skipped)
• composer validate --strict
• npm run test:inventory
• php -l includes/class-static-site-importer-url-site-collector.php
• php -l static-site-importer.php
• php -l tests/smoke-url-site-collector.php
• git diff --check

Compatibility

Existing callers that explicitly select include_scripts=true retain the prior full-fetch/full-markup behavior. The default intentionally changes to static retention. WordPress runtime and browser tests were not run because this worktree is not the installed Studio plugin and the shell has no standalone wp binary.

AI Assistance

OpenAI gpt-5.6-sol via OpenCode implemented and tested this change. Chris Huber remains responsible for every line.

[chubes4]

Follow-up verification\n\nCommit 1cde03cb resolves the scoped legacy PHPCS/PHPStan findings in PR-touched files only, without changing the script-policy contract.\n\nValidated locally:\n- homeboy review lint --placement local --changed-since origin/main (zero findings; PHPCS, PHPStan, and ESLint passed)\n- php tests/smoke-url-site-collector.php (52 assertions)\n- php -l includes/class-static-site-importer-url-site-collector.php\n- php -l static-site-importer.php\n- php -l tests/smoke-url-site-collector.php\n- git diff --check origin/main...HEAD\n\nThe existing CI matrix had already passed the functional suite on PHP 8.1, 8.2, 8.3, and 8.4; the replacement Homeboy Lint run is now queued from this push.\n\nAI assistance: OpenAI gpt-5.6-terra via OpenCode was used to inspect CI evidence, make the scoped cleanup, and run verification. Chris Huber remains responsible for the change.

[chubes4]

CI Completion\n\nThe replacement Test workflow passed on commit 1cde03cb:\n- Homeboy Lint\n- Homeboy Test (PHP 8.1)\n- Homeboy Test (PHP 8.2)\n- Homeboy Test (PHP 8.3)\n- Homeboy Test (PHP 8.4)\n\nResidual gate failure: the independent Solved Site Promotion workflow completed its fixture matrix but could not execute fixture 15-saas because WP Codebox could not download https://playground.wordpress.net/wp-cli.phar. The log reports ResourceDownloadError; this is an external runtime dependency failure, not a source or assertion failure from this PR. Evidence: https://github.com/Automattic/static-site-importer/actions/runs/30827202419/job/91731786083\n\nAI assistance: OpenAI gpt-5.6-terra via OpenCode was used to inspect and report CI evidence. Chris Huber remains responsible for the change.