fix: detect stale CLI builds

[chubes4]

Summary

• generate immutable wp-codebox/cli-build-provenance/v1 evidence after normal and release builds, binding package version, Git commit/ref, source identity, and compiled dist identity
• make wp-codebox doctor fail or warn actionably when source/dist/package provenance differs or the checkout is behind/diverged from its locally available upstream
• preserve packaged non-Git behavior and keep doctor non-mutating: it does not fetch, rebuild, or modify checkouts

Refs #1222
Related owner gap: Extra-Chill/homeboy-extensions#2677

Root Cause

The CLI previously reported only a package JSON hash and current Git HEAD. Compiled dist carried no immutable record of the source/version/commit that produced it, so doctor could not distinguish a fresh build from stale generated output. Release/deploy also correctly treated the private root npm package separately from the WordPress plugin artifact, leaving independently installed global copies untouched.

Ownership Boundary

WP Codebox owns its CLI source, build artifacts, package metadata, provenance, and diagnostics. This PR adds only that contract.

The WordPress Homeboy extension owns managed WP Codebox installation/refresh. Its setup currently accepts runnable ambient/global wp-codebox-workspace candidates based on runtime and minimum-version probes, including the production ~/.opencode install. Extra-Chill/homeboy-extensions#2677 tracks consuming this provenance contract and converging ambient stale installs without adding WP Codebox literals to generic Homeboy or Data Machine Code layers.

Provenance And Freshness Contract

• packages/cli/dist/cli-build-provenance.json records package name/version, source SHA-256 identity, dist SHA-256 identity, and build Git commit/ref.
• Build and release-build regenerate provenance after TypeScript compilation, then immediately verify it. A configured WP_CODEBOX_SOURCE_SHA that differs from checkout HEAD fails loudly.
• Doctor verifies package metadata and dist bytes for every installation.
• In a Git checkout, doctor also verifies tracked CLI source identity and build commit, then reports ahead/behind/diverged state against the configured locally available upstream.
• Doctor explicitly reports that it does not fetch. Missing configured upstream refs warn rather than being treated as fresh; no configured upstream is reported explicitly.
• Packaged CLIs outside Git verify immutable package/dist provenance without false positives.

Remediation Behavior

Doctor reports npm run build for stale source/dist checkouts and reinstalling a release artifact for stale packaged installs. Normal CLI commands never fetch, rebuild, or mutate Git. The existing explicit npm run wp-codebox:source -- ... launcher remains the safe source-checkout rebuild path.

Tests

Passed:

• npm run build
• npm run test:cli-build-freshness
• npm run smoke -- --command=doctor-command-smoke
• npm run smoke -- --command=source-checkout-entrypoint-smoke
• npm run smoke:cli-version
• npm run package:wordpress-plugin
• npm run smoke -- --group package
• npm run test:release-target
• npm run test:sharp-release-runtime
• npm run test:prepare-declaration-rebuild
• npm run test:release-package-coverage
• built wp-codebox doctor --json returned ok with matching source/dist/commit and explicit local-upstream/no-fetch evidence

The package-group Docker-backed disposable MySQL E2E reported its existing skip because docker info is unavailable; all other declared gates passed.

No secrets, generated version changes, CHANGELOG.md edits, release, deploy, or production source modification occurred.