Add end-to-end Cloudflare provisioning gate

[chubes4]

Summary

• add a focused local D1 gate for the complete public provisioning lifecycle
• exercise authenticated artifact staging, idempotent site allocation, scheduled import, cold restart, site reads, administrator claims, login, and editable native blocks
• accept an external canonical artifact with --artifact=<path> so independent producers can prove interoperability without writing directly to R2

Advances #1974.

Producer interoperability

A portable artifact emitted by WP Build through wpbuild_portable_site_artifact() was submitted as exact external bytes through the public API. The run created two editable WordPress pages using native core/paragraph blocks with zero fallback, HTML, freeform, or invalid blocks, then survived a Worker restart and administrator claim/login.

Reproduction shape:

wp wp-build export <project-id> --contract=ssi --out=/tmp/wp-build-artifact.json
npm run cloudflare:local-gate:provisioning -- --artifact=/tmp/wp-build-artifact.json

Verification

• npm run cloudflare:local-gate:provisioning
• npm run cloudflare:local-gate:provisioning -- --artifact=/tmp/wp-build-portable-artifact.json
• npm run test:cloudflare-runtime
• npm run cloudflare:dry-run:d1
• node --check scripts/cloudflare-local-gate.mjs
• git diff --check origin/main...HEAD

The broader pre-existing npm run cloudflare:local-gate currently fails its divergent coordinator-adoption assertion. The same failure was reproduced on untouched origin/main; this PR does not alter that coordinator behavior.

AI assistance

OpenAI gpt-5.6-sol via OpenCode drafted the implementation and verification workflow. Chris Huber reviewed and is responsible for the submitted changes.