Fix external WordPress WP-CLI global flag ordering

[chubes4]

Summary

• place generated --user and --path WP-CLI globals before caller subcommand arguments
• preserve configured transport prefixes as exact argv arrays on Bash 3.2 and newer
• cover user-bound and userless external WordPress profiles
• allow bounded Kimaki attribution lookups five seconds for hosted-runner process startup after the previous two-second bound failed twice in CI

Closes #367.

Verification

• bash tests/external-wordpress-runtime.sh
• bun tests/kimaki-session-attribution.mjs
• git diff --check
• Homeboy candidate tree 671f1c93c945abcdb826a71c34c0de2f7c7bf879 passed both durable gates in run cook-detached-2186c97b-f85f-4bd7-92e7-1a4ccffb1b7c-attempt-2-664612b0. Finalization was completed directly because Homeboy #12225 blocked reviewer-metadata recovery after the green promotion.

Compatibility

The wrapper retains transport-prefix and embedded-whitespace handling while producing WP-CLI-compatible global argument order. The Bash parser now supports the macOS-provided Bash 3.2 instead of requiring mapfile. Kimaki lookups remain bounded and cached; only the startup allowance changes from two to five seconds.

AI Assistance

OpenAI gpt-5.6-terra and gpt-5.6-sol via OpenCode implemented, reviewed, and verified the change. Chris Huber reviewed and remains responsible for every line.