feat: builder layout and design system reach RawIR (Elementor tree, Divi, global styles, block templates)

[ABB65]

Why

Migrate v3 builds the site from facts, and the builder layout was the missing fact:

• _elementor_data only arrived when an admin selected it.
• The Elementor kit globals, theme.json global settings/styles and block templates were not exported at all.
• REST cannot reach any of these.

Orchestrator approved this, with two conditions: keep status parity with wp-import mapStatus, and protected content must not leak.

What

• Post meta, understood without selection: _elementor_data (decoded JSON, so the secret filter reaches every widget setting), _elementor_page_settings, _elementor_edit_mode, _elementor_template_type, _elementor_version, and Divi's _et_pb_use_builder, _et_pb_page_layout, _et_pb_side_nav, _et_pb_post_hide_nav, _et_pb_show_title. _et_pb_old_content (the pre-builder backup) stays out.
• Password-protected post: none of those keys are exported. The exclusion is reported as password-protected.
• options (RawIR options, Bridge rung): stylesheet and template; global_settings and global_styles (theme.json merged with Site Editor changes); block_templates (templates and parts with raw block markup, block themes only); elementor_kit (the active kit's settings); et_divi. Every value goes through Policy::clean.
• Coverage: these options count as exported:design.

Conditions

1. Parity: status, password and visibility are not touched. wp-import already drops _elementor_* meta (CORE_META), so entries and statuses are unchanged. The test asserts that a protected post is still publish + [protected].
2. Protected content: a protected post's builder tree is excluded. The password is still never exported. The test plants secrets (form recipient email, Mailchimp key, reCAPTCHA secret, Divi API key, post password) and asserts that none reaches the output.

Tests

New tests/builder.php (npm run test:builder, a CI step after test:reader). It cleans up what it creates. Docker/PHP are not available on my machine, so this runs in CI.

Note: posts that carry builder meta get a new inventory fingerprint once, because meta is part of it, so the next delta run lists them as modified.

Reviewer: t6. Consumer: migrate @migrate/facts (#90) reads meta._elementor_data and options.

[ABB65]

main merged (4a6bd6a). The only conflict was includes/class-contentrain-bridge-policy.php: both sides added a fifth parameter to Policy::clean(). This branch added $max_depth (builder trees, BUILDER_DEPTH 64), and main added $field_names (#32: ACF names are judged by secret_name()).

Resolution: clean( $value, &$excluded, $path = '', $depth = 0, $field_names = false, $max_depth = 12 )

• $field_names stays fifth, as on main, so the ACF callers in source.php and models.php are unchanged.
• The recursion passes both parameters on.
• The builder callers now pass 0, false, …BUILDER_DEPTH: Policy::meta() for _elementor_data, and global_settings, global_styles and elementor_kit in exporter.php.
• sensitive() keeps the webhook|hook_url keys (QA-34).

CI is green (acceptance, large 64M/128M, PHP 7.4/8.3). For re-review: only the conflict resolution.

[ABB65]

t6 QA — Bridge #29 çakışma çözümü (4a6bd6a): ONAY

• clean($value, &$excluded, $path, $depth, $field_names = false, $max_depth = 12): özyineleme iki argümanı da taşıyor (satır 74).
• Merge sonrası bütün clean() çağrılarını taradım, pozisyon kayması yok:
  • Builder çağrıları 0, false, BUILDER_DEPTH geçiriyor: global_settings, global_styles, elementor_kit, ayrıca meta() içinde $builder ? BUILDER_DEPTH : 12.
  • ACF çağrıları 0, true geçiriyor (source ×2, models acf-options-schema), bu yüzden max_depth varsayılan 12'de kalıyor.
  • SEO, redirects ve scanner çağrıları üç argümanla varsayılanlara düşüyor.
• sensitive() içindeki webhook|hook_url (QA-34) ve main'deki secret_name() birlikte duruyor.
• CI yeşil (PHP 7.4 ve 8.3, acceptance).