feat(release): add WordPress platform support

[callinmullaney]

Summary

Ships WordPress as a first-class platform, fixes the packaging defect in 2.2.0, and hardens the cache, CLI surface, and release pipeline.

Platform

• Adds wordpress as a supported platform alongside drupal and none, with the built-in WordPress starter and detection for standard WordPress, Bedrock, and Composer web-root layouts.
• Adds platform compatibility expressions on system variants (drupal || wordpress), so a shared component system can target multiple platforms. Variant selection prefers an exact match, then a compatible variant, then a generic none variant.
• Adds emulsify audit, delegating to the project-installed @emulsify/core audit.

Packaging

• Removes the vendored dependency tree from the published tarball. 2.2.0 shipped 1,560 files (7.41 MiB unpacked) including 1,499 under dist/node_modules/; this ships 63 files at 35.6 KiB packed.

Cache

• Keys the cache by repository URL in addition to project path and checkout, so different repositories with the same basename can no longer collide.
• Writes a metadata sidecar after a successful clone, making an interrupted clone detectable and recoverable instead of permanently poisoning the entry.
• Clones to a temp directory and atomically renames into place, so a concurrent run can never observe a partial tree. Lock-free, so a killed process cannot wedge the cache; abandoned temp directories are reaped.
• Bounds the remote ref lookup with a hard 2s timeout and GIT_TERMINAL_PROMPT=0; a timeout falls back to the cached clone rather than failing the command.
• Adds emulsify cache clear with --dry-run, and a --refresh flag on the component commands.

Correctness

• component install now exits non-zero when a requested component fails to install. It previously logged a warning and exited 0, so emulsify component install x && npm run build would proceed against a missing component.
• The .cli/systemInstall.js hook now runs. The path was being joined onto system.emulsify.json itself rather than its directory, so the documented hook had never fired.
• findFileInCurrentPath now terminates at the filesystem root on Windows and UNC paths, where it previously looped forever, and finds a config file located at the root.
• Cached system configurations are now validated on the read path used by component list, install, and create. An unrecognized variant platform is skipped with one warning instead of throwing for the whole variant list.
• --repository and --checkout are now required together; passing either alone previously fell through and silently installed a different system.
• Removes the global -c/--checkout, which was registered and documented but never read, and corrects a system install error that advertised a --name flag that never existed.

CI and release

• Unit suite now runs on ubuntu, macOS, and Windows. Packaging and release verification stay on ubuntu.
• Enables npm provenance, SHA-pins all workflow actions, adds the github-actions Dependabot ecosystem, and removes contributors.yml, which ran an unpinned third-party action with a PAT against a README heading that no longer exists.
• Adds an end-to-end suite that runs the built binary against local git fixtures in an isolated $HOME.

Repo

• Adds CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, CODEOWNERS, issue forms, this PR template, and .editorconfig.
• Corrects prepare to husky (the husky install subcommand is deprecated in v9) and narrows lint-staged so a commit no longer reformats the entire src/ tree. Removes the lint script, which ran the test suite, and the orphaned tsconfig.eslint.json; ESLint is not installed in this project.
• Dependency refresh: npm audit is clean, down from 7 high advisories including one in production dependencies.

Related Issue

Closes #192

Verification

• npm run build
• npm run type
• npm test
• npm run pack:dry-run
• npm run smoke:pack

Run from a clean clone on Node 24: 49 suites / 407 tests, e2e 6/6 with 0 todos, npm ci reports 0 vulnerabilities, packed artifact is 63 files / 35.6 KiB / 139.2 KiB unpacked. npm run release:analyze predicts minor: v2.2.0 -> v2.3.0 from 31 commits and confirms the squash title preserves the release type.

Checklist

• I added or updated tests for behavior changes.
• I updated documentation for user-facing changes.
• I did not manually change the package version; the release workflow owns it.

Notes

Cache format change. The cache key changed, so the entry from 2.2.0 is orphaned rather than migrated. Run emulsify cache clear once after upgrading to reclaim the disk. Stale entries cannot be mistakenly reused — reuse requires a sidecar 2.2.0 never wrote.

Behavior changes worth knowing. A failed dependency install now also fails the command, not just a failed requested component. emulsify -c <ref> <command> now errors as an unknown option instead of being silently ignored.

Placeholders to fill. SECURITY.md has a TODO(contact) for the private reporting address, and .github/CODEOWNERS has no rules yet — both were deliberately left for a maintainer rather than invented.

Before merging: branch protection still references CI / Validate, which no longer exists. The required checks are now CI / Unit (ubuntu-latest), CI / Unit (macos-latest), CI / Unit (windows-latest), and CI / Package.

Follow-ups: getRepositoryLatestTag still makes an unbounded ls-remote and should get the same timeout treatment as the cache lookup. --variant was registered under a test: commit so it won't appear in the generated release notes.

[github-actions]

🎉 This PR is included in version 2.3.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀