ci: add PRAUTOBLOGGER_* constants guard (scripts/check-constants.php)

Wires a new required CI step — 'Check PRAUTOBLOGGER_* constants' — that
fails the build when any PRAUTOBLOGGER_* constant referenced in the
shipped plugin PHP is neither:
  (a) define()d in prautoblogger.php (including conditional OPIK defines), nor
  (b) protected by a defined() guard at the reference site.

This closes the regression class that caused the v0.19.0 admin-500 incident:
PR #156 deleted three constants from prautoblogger.php; CI stayed green because
tests/bootstrap.php holds fallback copies, masking the gap until prod boot.

Deliverables:
  - scripts/check-constants.php (212 lines, no Composer deps, PHP 8.1+)
  - .github/workflows/ci.yml: new 'check-constants' job
  - CHANGELOG.md: one-line note under [Unreleased - Internal]

No plugin version bump (CI-only; shipped artifact unchanged).

AC-1 verified locally (Python3 equivalent logic):
  - HEAD passes clean (0 violations)
  - Remove PRAUTOBLOGGER_DEFAULT_RUN_CEILING_USD -> 2 violations caught
  - Remove PRAUTOBLOGGER_DEFAULT_REQUEST_JSON_RETENTION_DAYS -> 3 violations caught
  - Remove PRAUTOBLOGGER_DEFAULT_REASONING_MAX_TOKENS -> 1 violation caught

Agent-Session: ci-constants-guard-20260614

CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to PRAutoBlogger will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project uses [Semantic Versioning](https://semver.org/).
 
+## [Unreleased - Internal]
+
+### Internal
+- CI constants guard (`scripts/check-constants.php`): new required CI step (`Check PRAUTOBLOGGER_* constants`) fails the build when any `PRAUTOBLOGGER_*` constant referenced in shipped plugin PHP is neither defined in `prautoblogger.php` nor `defined()`-guarded at the reference site. Prevents a recurrence of the v0.19.0 admin-500 regression class.
+
 ## [0.20.1] - 2026-06-12
 
 ### Fixed