architecture: extract Cardea_Comment_Gate, single version source, unified excludes, shared e2e fixtures

[bornmw]

Stacked on #2 (security). Fixes the architecture findings from the review in #1 (A1-A6) and is behavior-neutral (same suite results, no new findings).

Changes

A1 + A2 — Cardea_Core is now a pure PoW domain (includes/class-cardea-core.php, new includes/class-cardea-comment-gate.php): the comment-form gate (preprocess_comment), the REST gate (rest_pre_insert_comment), all $_POST reads and wp_die calls moved to a new Cardea_Comment_Gate class that uses Cardea_Core. Cardea_Core no longer touches any request superglobal or wp_die — it holds challenge generation, HMAC signing, difficulty, time window, the challenge-string builder, the solution verifier, the replay store, and the cardea/v1/challenge REST endpoint.

A3 — single source of truth for the version: the PHPUnit bootstrap now parses CARDEA_VERSION from the cardea.php header (preg_match('/^\s*\*\s*Version:\s*(\S+)/m', ...) / falls back 0.0.0) instead of re-typing it. The two copies can no longer drift.

A4 — dead PSR-4 mapping removed: composer.json dropped the autoload block that mapped Cardea\\ onto includes/ while the files declare no namespace. (See pushback below on namespacing itself.)

A5 — one exclusion list (Makefile): EXCLUDE_DIRS / EXCLUDE_FILES / EXCLUDE_GLOBS feed both make package (zip) and make sync-svn (rsync). Verified: make package still produces the same 13-file dist/cardea.zip; make -n sync-svn unchanged against the 1.0.1 SVN working copy.

A6 — e2e fixtures: six duplicated Playground bootstraps (5 specs) now use tests/e2e/support/playground.js (startPlayground({ login, postTitle, extraRunPHP })); WP version overridable via WP_VERSION env (default latest).

Pushback (per #1)

• A4 (namespacing) — no class rename. Renaming Cardea_Core/Cardea_Comment_Gate to a Cardea\\ namespace is an unnecessary compat-breaking diff for a released plugin (hooks/objects are referenced by class name across the plugin and in tests). The dead autoload mapping is removed; the namespacing itself is deferred (or declined).

Test evidence

Full suite green (Docker, make test + make lint):

• Jest 12/12 — unchanged (no behavioral diff)
• PHPUnit OK (33 tests, 59 assertions) — submission tests moved to tests/phpunit/Cardea_Comment_Gate_Test.php (17 tests, incl. mock-WP_REST_Request REST parity); Cardea_Core_Test.php stays pure domain (16 tests)
• Playwright 20/20
• PHPCS clean (incl. a WPCS NonceVerification scoping fix surfaced by the new file)