chore: harden QA release and repo process

[dknauss]

Summary

• Hardens autosave/reset/exit request ordering so pending or in-flight saves are not lost during Exit or Reset All.
• Adds uninstall cleanup for maestro_config and ships it in the runtime build.
• Expands QA/tooling: PHPStan, Composer/npm audits, PHP syntax matrix, JS/docs checks, runtime ZIP artifact, and Plugin Check on the built plugin tree.
• Adds repo health files: contributing, security, support, code of conduct, issue/PR templates, Dependabot, CODEOWNERS.
• Updates docs/version drift and adds a Claude planning handoff at .planning/reviews/code-review-followup-2026-06-20.md.

Verification

• composer validate --strict
• composer test:unit — 44 passed
• composer lint — 8 passed
• composer analyse:phpstan
• npm run test:js — 53 passed
• npm run audit:npm
• npm run check:doc-links
• bash bin/build.sh
• npm run test:php — 29 passed, 81 assertions
• npm run test:e2e — 25 passed
• wp plugin check against build/maestro-menu-editor — no errors

Follow-up planning

Claude should review .planning/reviews/code-review-followup-2026-06-20.md and decide which recommended backlog items belong in the current milestone.

Notes

• The @wordpress/env → js-yaml audit finding is dev-only and documented in bin/audit-npm.mjs; remove the allowlist once upstream ships a clean dependency path.
• The Phase 7 screenshot changes were present before this commit and are included in this branch.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.