No project-level composer.lock → full Packagist fetch was timing out with SSL error 28 on every run. Switch to setup-php built-in phpcs tool + composer global require for WPCS, matching the pattern used in prautoblogger which does not need a lock file for the global install path. Refs #4