[WIP] Run nightly CI tests again

[Copilot]

• Investigate failing nightly CI tests (4 failures in ExitPathTest.php)
• Fix tests/Integration/bootstrap.php: add define('WP_ADMIN', true) so detect_surface() returns 'admin' for admin tests
• Fix includes/class-gate.php challenge_admin(): make exit conditional on wp_safe_redirect() return value so tests can verify redirect without being killed by exit
• Run PHP tests and static analysis to verify no regressions
• Run code review + CodeQL scan

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

🎮 Try in WordPress Playground

Open this PR in Playground →

Logs in as admin / password and installs the plugin from this PR's commit.

✅ What you can test

Feature	Notes
Plugin activation & settings page	✅
Gate fires on dangerous actions (plugin activate/delete, user delete, etc.)	✅
Challenge / reauthentication page	✅
Password verification & session cookie	✅
Admin bar countdown timer	✅
Request stash & replay after auth	✅
Rate limiting / 5-attempt lockout	✅ within session
Session expiry by time	✅ wait out the configured duration (1–15 min)
Two Factor plugin (TOTP)	✅ installed automatically via blueprint
unfiltered_html removed from Editor role	✅

❌ What won't work

Feature	Why
WP-CLI / Cron entry point policies	No CLI in browser
REST / XML-RPC entry point policies	Network disabled in Playground
Two Factor email / magic-link providers	PHP outbound network is off
Multisite behaviour	Single-site only
State after refreshing Playground	Full reset on page reload

Transients and user meta persist across normal WP navigation within
a session, but are wiped if you reload the Playground page itself.
Use the integration test suite to verify
transient TTL, real bcrypt, and multisite isolation.