Load external PHP.wasm extension manifests

[chubes4]

Summary

Let recipe callers declare startup-loaded PHP.wasm extension manifests through a generic JSPI-only runtime contract.

What changed

• Validate recipe-local or HTTPS manifest references, preserve them through dry-run/runtime normalization, and resolve local paths without traversal.
• Forward each manifest as the installed @php-wasm/node manifestUrl contract to every pooled programmatic PHP runtime instance.
• Fail with a structured capability diagnostic when external manifests are requested on Asyncify.

How to test

1. Run npm install; expect Workspace dependencies install successfully..
2. Run npm exec -- tsx tests/php-wasm-extension-manifests.test.ts; expect The manifest contract test prints php wasm extension manifests ok..
3. Run npm run build; expect All runtime-core, runtime-playground, and CLI TypeScript projects compile..

Compatibility

Backwards compatible: recipes without runtime.extensions are unchanged. Consumers opting into external manifests require a JSPI-capable Node runtime and ABI-compatible extension artifacts; Asyncify requests fail explicitly. No WPCOM, Sodium, or product-specific behavior is added to WP Codebox.

Evidence

• Base advanced after verification: verified main at 6945541; publication observed 6d16138. Candidate ancestry was validated against the verified snapshot.
• PHP.wasm extension manifest contract: Passed
• Reviewer-resolvable source evidence: Provide PHP Sodium capability for WPCOM PHPUnit runtimes #1825
• Reviewer-resolvable source evidence: [PHP] Support custom PHP.wasm extensions WordPress/wordpress-playground#3566
• Reviewer-resolvable source evidence: [PHP] @php-wasm/compile-extension – a workflow for building custom extensions WordPress/wordpress-playground#3582
• Reviewer-resolvable source evidence: [PHP] Limit external extensions to JSPI WordPress/wordpress-playground#3587
• Reviewer-resolvable source evidence: [CLI] Load custom PHP.wasm extensions WordPress/wordpress-playground#3616
• Verified finalization base: main at 6945541

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode
• Model: openai/gpt-5.6-terra
• Used for: Implemented the generic manifest contract and tests; OpenCode GPT-5.6 Sol reviewed the runtime boundary and coordinated deterministic gate feedback with Chris.

Source relationships

• Closes Provide PHP Sodium capability for WPCOM PHPUnit runtimes #1825