Add Cloudflare WordPress runtime gate

[chubes4]

Summary

• add an isolated Cloudflare Worker integration that boots real WordPress through WordPress Playground
• return a stable WP Codebox health payload inside the existing runtime command-result envelope
• add deterministic envelope coverage, real local workerd boot verification, Wrangler dry-run packaging, and operator documentation
• keep Durable Objects, R2, persistence, serialization, and cold restoration behind the future backend boundary

Addresses #1838 as the first staged WordPress boot gate.

How to test

1. Check out this branch from a fresh clone and run npm ci.
2. Run npm run build.
3. Run npm run test:cloudflare-runtime.
4. Run npm run test:runtime-command-result-envelope.
5. Run npm run cloudflare:local-gate; expect two HTTP 200 health envelopes and automatic local server cleanup.
6. Run npm run cloudflare:dry-run; expect Wrangler to report an upload around 21.3 MiB uncompressed and 7.95 MiB gzip without creating Cloudflare resources.
7. Run git diff --check.

Compatibility

This is an additive private workspace package and root command surface. Existing runtime-core, runtime-playground, CLI, browser, and host behavior is unchanged. The only runtime-core surface change is a direct package export for the existing runtime-command-result module. No extension paths are removed or redirected.

Remote gate

Local workerd proves packaging and real WordPress boot wiring, but not Cloudflare's 128 MB isolate limit. The remote Worker deployment remains an explicit operator action documented in packages/runtime-cloudflare/README.md.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with gpt-5.6-sol
• Used for: Implemented the additive Cloudflare runtime gate, fixed the real workerd boot path, added behavioral verification and documentation, and verified the candidate with Chris; Chris reviews and owns the change.