Contain import report artifacts

[chubes4]

Summary

• remove caller-selected report filesystem paths from REST and Ability schemas; remote Ability calls that include report receive a structured rejection
• retain --report as an explicit WP-CLI-only output seam, with importer-owned validation reports retaining their existing internal destination
• preflight and recheck the report plus validation/finding sidecars: existing targets, missing parents, traversal segments, and symlinked components are rejected before atomic writes

Compatibility

• REST and Ability callers must consume the response-embedded import report and diagnostics rather than passing report
• CLI --report remains supported, but now requires a new target in an existing physical directory; the sibling sidecars must also be absent

Tests

• npm test (51 selected checks passed, 0 failed)
• PHP syntax sweep: for file in static-site-importer.php includes/*.php; do php -l "$file"; done
• Added regression coverage for remote schema/Ability rejection, CLI seam routing, existing targets and sidecars, missing parents, traversal, and symlinks

Fixes #856

AI assistance disclosure: OpenAI GPT-5.6 Sol via OpenCode was used to inspect the report-output contract, implement the containment boundary, and add regression tests. Chris Huber remains responsible for every line.