v0.3.2 — adopt estate CI: PHPUnit suite + reusable pipeline + governance workflows

- Convert 17 hand-rolled tests to PHPUnit TestCases (tests: stubs pattern)
  P0 security tests preserved: key-leak/encryption (KeyStoreTest),
  capture-allowlist/executor-path sentinel (CaptureWriterTest)
- Add phpunit.xml.dist + update tests/bootstrap.php (Composer autoloader first)
- Add phpunit/phpunit ^9.6 + yoast/phpunit-polyfills ^2.0 to require-dev
- composer test -> vendor/bin/phpunit --configuration phpunit.xml.dist
- ci.yml: thin caller of peptide-e2e reusable CI (tests: stubs, has_js: true,
  workflow_call trigger, permissions: contents: write)
- deploy.yml: estate pattern caller of peptide-e2e deploy-app.yml@main
  (target_path: wp-content/plugins/pr-vision, gated on reusable CI)
  Pull-deploy on Hostinger stays as break-glass
- Add cto-review.yml (Haiku-only, A/B panel dropped 2026-06-12)
- Add main-push-audit.yml (direct-push tripwire)

Agent-Session: claude-adopt-ci-20260616

composer.json

@@ -1,12 +1,14 @@
 {
 	"name": "peptiderepo/pr-vision",
-	"description": "AI-visibility (GEO) monitoring dashboard for peptiderepo.com \u2014 weekly LLM probes, cost ledger, trendline admin panel.",
+	"description": "AI-visibility (GEO) monitoring dashboard for peptiderepo.com — weekly LLM probes, cost ledger, trendline admin panel.",
 	"type": "wordpress-plugin",
 	"license": "GPL-2.0-or-later",
 	"require": {
 		"php": ">=8.1"
 	},
 	"require-dev": {
+		"phpunit/phpunit": "^9.6",
+		"yoast/phpunit-polyfills": "^2.0",
 		"squizlabs/php_codesniffer": "^3.13",
 		"wp-coding-standards/wpcs": "^3.0",
 		"phpcsstandards/phpcsutils": "^1.0",
@@ -18,7 +20,8 @@
 		}
 	},
 	"scripts": {
-		"lint": "phpcs -n",
-		"lint:fix": "phpcbf"
+		"test": "vendor/bin/phpunit --configuration phpunit.xml.dist",
+		"lint": "vendor/bin/phpcs",
+		"lint:fix": "vendor/bin/phpcbf"
 	}
 }