Fork hardening wave tracker: tooling, REST, CLI, and editor PRs

[dknauss]

Context

This issue tracks a fork-first hardening/stabilization wave prepared as four focused PRs against develop. Upstream merge timing is optional for fork delivery; each PR is intentionally reviewable as a standalone change set.

PRs

• Tooling/CI: coverage gate + PHPStan baseline refresh #162 Tooling/CI: coverage gate + PHPStan baseline refresh
• REST hardening: guest-author creation and post-insert observability #163 REST hardening: guest-author creation and post-insert observability
• CLI migrations: pacing controls and post-type normalization #164 CLI migrations: pacing controls and post-type normalization
• Editor: move AuthorsSelect init side effects to useEffect #165 Editor: move AuthorsSelect init side effects to useEffect

Packaging notes

• Security/observability, CLI migration reliability, and editor JS behavior are split to reduce review coupling.
• If PR CLI migrations: pacing controls and post-type normalization #164 proves too broad during review, it can be split into pacing-hook and post-type-validation follow-ups.

Fork-local status

• Phase completion is not gated on upstream merge outcome.
• This issue is for review coordination only.

[rmccue]

I'll copy my comment from #164 here:

@dknauss Can you please not spam this repository with AI-generated pull requests? It's incredibly noisy for all of us watching this repository, and it's not clear what problems you're trying to solve when it's only AI output in your PR descriptions - include what you're trying to solve and we can run the AI ourselves, don't just give the outputs.

I'll leave your pull requests open if you want to correct them to include useful information, otherwise we'll close them.

[dknauss]

Yes, I saw that and I apologize for the noise. Initially, I set Claude up to operate only on my fork, but that failed at some point, and the most I could do after I realized that was reset and trim things back.