Fix Composer discovery for public package classes

[chubes4]

Summary

• classmap WP_Agent and the public package definition directory through Agents API's Composer metadata
• keep agents-api.php as the idempotent runtime bootstrap while exposing public package types lazily
• add a consumer-only PHPStan fixture that resolves package, capability, artifact-status, and hashing contracts with no custom include or handwritten stubs

Why

Guarded WordPress-style global classes were invisible to Composer-aware static analysis because agents-api.php deliberately returns under PHPStan. Downstream projects had to scan Agents API's internal source paths themselves.

The package now owns discovery directly. Consumers only load normal Composer autoload; no opt-in NEON, internal path knowledge, or runtime bootstrap execution is required.

Verification

• consumer-only PHPStan fixture: passed at level 7 with no custom dependency config
• Agents API max-level PHPStan: passed
• complete composer smoke suite: passed, including the consumer fixture
• Composer autoload outside WordPress remains inert and package classes remain lazily loaded
• normal WordPress bootstrap: passed
• version-skew symbol top-up: passed
• Homeboy changed-file lint: passed
• Homeboy architecture audit: no introduced findings
• production package build and PHP syntax validation: passed
• Composer validation and git diff --check: passed

Closes #524