Evaluate WP-CLI package and Trellis extension distribution paths

[jasperf]

Two cross-linked documents assessing whether this repo's tooling should ship through the WordPress and Trellis ecosystems' own channels.

wp-cli-package-evaluation.md rewrites an earlier draft whose compatibility table was fabricated: it rated wp-cli/migration and wp-cli/seo at 85-90% WP-CLI compatible when neither directory contains PHP, and rated the security scanners at 90% "uses WP_CLI APIs" when they contain zero WP_CLI references. Eighteen of its seventy estimated hours were budgeted against files that do not exist. The rewrite records the verified inventory (16 wp-cli commands: 5 PHP, 11 Bash; exactly one file uses the WP-CLI API), keeps a corrections section since the old conclusions are still circulating, and narrows the recommendation to publishing the one pattern-validate command. It also argues against packaging the scanners, whose lack of WP_CLI coupling is deliberate — it is what lets them run on hosts that have no WP-CLI at all.

trellis-extensions-evaluation.md is new. It separates the two mechanisms that "Trellis extension" conflates: Ansible Galaxy roles, which is what the roots.io directory lists, and trellis-cli's undocumented git-style plugin system, verified against trellis-cli v1.19.0 and confirmed by running a plugin. Any executable named trellis-* on PATH becomes a subcommand, so a trellis-wpops symlink makes the existing binary a trellis subcommand with no new code — tested end to end. Records the core-namespace guard that silently skips plugins whose first segment matches a core command, which is why trellis-db-pull can never work.

Ecosystem survey finds ~190 stars across three unmaintained projects duplicating trellis/backup, and no published extension doing Nginx log analysis, so the recommendation ships monitoring first. Includes the trellis-sync repo assessment: archived, with its seven open issues answered, and named as the backup role's home over a new repo.