[Push] Serve push requests without loading WordPress

[adamziel]

Files-push can now use a standalone PHP route that remains reachable when pushed code prevents WordPress from starting.

Background

Before this PR, every push request used the WordPress front controller. A push could install a plugin which throws during WordPress startup, and the next push could not reach push_create to replace it.

This change

The exporter plugin now exposes push.php, which authenticates and dispatches every push operation without loading WordPress. While WordPress is healthy, it writes the current connection token, push authorization, document root, reprint directory, exclusions, and request limits to a mode-0600 private configuration file. Revoking push blocks new work while retaining the existing durable-commit recovery rule.

files-push accepts that route through --push-url. The positional remote Reprint API URL still selects the remote state directory and shared local index used by pull, diff, and push. An active sender records its push URL and refuses to resume through another route.

The existing WordPress push route remains available for compatibility. Hosts which block direct plugin PHP execution must allow push.php or provide another route which does not load WordPress.

Testing

The endpoint test pushes a plugin which breaks WordPress startup, confirms the WordPress route returns 500, then runs another files-push through push.php and confirms the safe plugin replaces it. It also covers connection-token authentication, revoked authorization, excluded paths, and shared local-index ownership.

Supersedes #378.

[github-actions]

Pull pipeline performance — large-directory

Site: large-directory · 2,000+ plus targeted file-transfer scenarios files · 10,000 posts · 25,000 postmeta · PHP 8.5.9

Stage	PR	trunk	Δ	Status	Details
playground-sqlite-db-pull	9.45 s	9.31 s	⚪ +137 ms (+1.5%)	✓	condition=db-pull in PHP.wasm runtime=php.wasm 8.3 wp_mysql_parser=enabled mode=lexer native_lexer=verified native_token_stream=WP_MySQL_Native_Token_Stream native_token_count=18 native_parser=selected trunk: condition=db-pull in PHP.wasm runtime=php.wasm 8.3 wp_mysql_parser=enabled mode=lexer native_lexer=verified native_token_stream=WP_MySQL_Native_Token_Stream native_token_count=18 native_parser=selected
playground-sqlite-db-apply	3.62 s	3.54 s	⚪ +81 ms (+2.3%)	✓	condition=db-apply to SQLite in PHP.wasm runtime=php.wasm 8.3 wp_mysql_parser=enabled mode=parser native_lexer=verified native_token_stream=WP_MySQL_Native_Token_Stream native_token_count=18 native_parser=verified native_ast=WP_MySQL_Native_Parser_Node sqlite_driver_parser=verified trunk: condition=db-apply to SQLite in PHP.wasm runtime=php.wasm 8.3 wp_mysql_parser=enabled mode=parser native_lexer=verified native_token_stream=WP_MySQL_Native_Token_Stream native_token_count=18 native_parser=verified native_ast=WP_MySQL_Native_Parser_Node sqlite_driver_parser=verified
Total	13.07 s	12.85 s	⚪ +218 ms (+1.7%)

_{Numbers carry runner noise; treat single-run deltas as directional, not authoritative.}

_{📈 Trunk performance history — commit-by-commit timeline.}