v0.3.2 — adopt estate CI: PHPUnit suite + reusable pipeline + governance workflows

- Convert 17 hand-rolled tests to PHPUnit TestCases (tests: stubs pattern)
  P0 security tests preserved: key-leak/encryption (KeyStoreTest),
  capture-allowlist/executor-path sentinel (CaptureWriterTest)
- Add phpunit.xml.dist + update tests/bootstrap.php (Composer autoloader first)
- Add phpunit/phpunit ^9.6 + yoast/phpunit-polyfills ^2.0 to require-dev
- composer test -> vendor/bin/phpunit --configuration phpunit.xml.dist
- ci.yml: thin caller of peptide-e2e reusable CI (tests: stubs, has_js: true,
  workflow_call trigger, permissions: contents: write)
- deploy.yml: estate pattern caller of peptide-e2e deploy-app.yml@main
  (target_path: wp-content/plugins/pr-vision, gated on reusable CI)
  Pull-deploy on Hostinger stays as break-glass
- Add cto-review.yml (Haiku-only, A/B panel dropped 2026-06-12)
- Add main-push-audit.yml (direct-push tripwire)

Agent-Session: claude-adopt-ci-20260616

.github/workflows/deploy.yml

@@ -1,70 +1,27 @@
-name: Deploy to Hostinger
+name: Deploy to WordPress
 
 on:
   push:
     branches: [ main ]
 
+# contents: write required so the ci.yml caller can pass write permission
+# through to the phpcbf auto-commit step in the reusable workflow.
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: deploy-pr-vision
   cancel-in-progress: true
 
 jobs:
-  ci:
-    name: Pre-deploy CI
+  test:
+    name: Pre-deploy tests
     uses: ./.github/workflows/ci.yml
 
   deploy:
-    name: Deploy (rsync to Hostinger PROD)
-    needs: ci
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up SSH key
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_deploy
-          chmod 600 ~/.ssh/id_deploy
-          ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null
-
-      - name: rsync plugin to PROD
-        run: |
-          rsync -az --delete \
-            --exclude='.git' \
-            --exclude='.github' \
-            --exclude='tests' \
-            --exclude='phpunit.xml.dist' \
-            --exclude='composer.json' \
-            --exclude='composer.lock' \
-            --exclude='vendor' \
-            --exclude='phpcs.xml.dist' \
-            --exclude='*.md' \
-            -e "ssh -p ${{ secrets.SSH_PORT }} -i ~/.ssh/id_deploy -o StrictHostKeyChecking=no" \
-            ./ \
-            "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/wp-content/plugins/pr-vision/"
-
-      - name: Purge LiteSpeed cache
-        run: |
-          ssh -p "${{ secrets.SSH_PORT }}" \
-            -i ~/.ssh/id_deploy \
-            -o StrictHostKeyChecking=no \
-            "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}" \
-            'wp --path=~/domains/peptiderepo.com/public_html litespeed-purge all 2>/dev/null || true'
-
-      - name: Health check (expect 200 or 403)
-        run: |
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
-            --max-time 15 \
-            "https://peptiderepo.com/wp-admin/admin.php?page=pr-vision" \
-            -L --user-agent "GitHub-Actions-Deploy-Health-Check/1.0")
-          echo "HTTP status: $STATUS"
-          if [ "$STATUS" = "200" ] || [ "$STATUS" = "403" ]; then
-            echo "Health check passed."
-          else
-            echo "Health check FAILED with status $STATUS"
-            exit 1
-          fi
+    name: Deploy (shared pipeline)
+    needs: test
+    uses: peptiderepo/peptide-e2e/.github/workflows/deploy-app.yml@main
+    with:
+      target_path: wp-content/plugins/pr-vision
+    secrets: inherit