feat: support portable external WordPress runtimes

[chubes4]

Summary

• add an explicit OpenCode external-runtime profile that separates the runtime root from the WordPress-side path
• execute WordPress operations through an argv-safe, environment-supplied control transport with optional user mapping
• project Data Machine context into atomic runtime-local generations and keep OpenCode, Kimaki, skills, and guidance below the runtime root
• generate credential-free WP control and Kimaki launchers while keeping transport credentials out of files and service definitions
• reject unsupported runtime selections, preserve colocated defaults, and document/profile/verify the new flow

Closes #358.

Verification

• bash tests/external-wordpress-runtime.sh passed repeatedly, including concurrent projection, symlink containment, stale-file removal, newline argv, secret non-persistence, launcher propagation, and idempotence coverage
• node tests/setup-profile-compiler.mjs passed
• bash tests/ci-coverage.sh passed
• focused OpenCode, repair, service identity, Kimaki attribution, and Data Machine sync suites passed
• all shell suites before and after inherited macOS fixture failures passed
• bash -n, Python compilation, and git diff --check passed

Local macOS full-suite caveats reproduced on unchanged main: root/systemd-only service migration and verify fixtures remain red locally, while smoke-cli-transport.php requires Linux setsid for its process tests. CI remains the Linux compatibility authority for those suites.

AI Assistance

OpenAI gpt-5.6-sol via OpenCode was used to inspect the architecture, implement and review the change, and run verification. Chris Huber reviewed and is responsible for every line.