[chubes4]

Relates to #2255 and merged #2257.

Summary

• create a runner-owned WP Codebox artifact scope per PHPUnit invocation
• accept only a runtime-<alphanumeric-or-hyphen> pointer basename, resolve it canonically, and require it to remain directly under that invocation's artifact scope
• consume PHPUnit diagnostics, test-results.json, and failure sidecars only from the validated current runtime artifact
• preserve caller-owned artifacts, so stale caller-level NO_TEST_FILES and test-result sidecars cannot mask a current startup failure
• add a real readonly-source canary covering structured diagnostics, source hash stability, and no host PHPUnit cache

Dependencies

Depends on merged Automattic/wp-codebox #1799, #1804, and #1805.

Fresh-checkout tests

1. cd wordpress && node tests/wp-codebox-phpunit-recipe-builder-smoke.js
2. cd wordpress && bash scripts/test/wp-codebox-mount-translation-smoke.sh
3. cd wordpress && bash -n scripts/test/test-runner-wp-codebox.sh scripts/test/wp-codebox-mount-translation-smoke.sh scripts/test/playground-db-activation-smoke.sh
4. Build WP Codebox at merged b8c4cfe, then run HOMEBOY_WP_CODEBOX_INSTALL_DIR=/var/empty/wp-codebox HOMEBOY_WP_CODEBOX_BIN=<wp-codebox>/packages/cli/dist/index.js HOMEBOY_WP_CODEBOX_CORE_MODULE=<wp-codebox>/packages/runtime-core/dist/recipe-builders.js HOMEBOY_CORE_DIR=<homeboy> bash wordpress/scripts/test/playground-db-activation-smoke.sh. The empty install directory ensures the selected CLI and recipe-builder module come from that exact build.
5. git diff --check

Compatibility

Readonly component sources remain immutable. Malformed or out-of-scope runtime pointers fail closed with an actionable diagnostic. PHPUnit result sidecars now come only from the validated current runtime artifact; unrelated caller artifacts remain intact.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode/openai-gpt-5.6-sol
• Used for: Implemented strict runtime artifact pointer validation, current-run sidecar routing, regression coverage, and merged-runtime verification; Chris reviews and owns the change.