chore: Update deps and cleanup scaffold (first pass)

[justlevine]

What

This PR aligns the plugin scaffolding and configs with WordPress/ai , and updates deps to their latest version.

There are no production code changes to this PR.

Why

Cleanup preparation before the release on WORG.

• Part of [Tracking 📌] Path to WordPress.org Plugin Directory #178

How

• Deps updated and dependabot added.
• Configs reset to WordPress/ai and then restored mcp-adapter-specific changes.
• PHPUnit now runs using .wp-env.test.json
• Removed the stale and unnecessary README_INITIAL.md

Script Changes

• composer lint:php -> composer lint
• composer lint:php:fix -> composer format
• composer lint:php:stan -> composer phpstan

New:

• npm run wp-env:test - Starts the isolated test environment.
• npm run wp-env:cli - Alias for running a command in the local cli environment plugin dir.

Not Included

This will be handed in separate PRs

• Fixing PHPUnit test slop
• New GH Workflows (PCP, Dependency Review, Playground Preview)
• Plugin-specific changes for loading as a library/package
• Docs/ context cleanup.

[justlevine]

The PHPUnit test failures are unrelated to this change:

• GitHub Actions workflow updates #179 (comment)

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: justlevine <justlevine@git.wordpress.org>
Co-authored-by: galatanovidiu <ovidiu-galatan@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR updates development scaffolding, dependency/tooling configuration, and repository metadata for the MCP Adapter plugin, aligning it more closely with the WordPress/ai setup while keeping production PHP behavior mostly unchanged.

Changes:

• Updated Composer/npm dependencies, scripts, PHPStan/PHPCS/PHPUnit configs, and wp-env test setup.
• Added Dependabot, security policy, PR template, npm policy, and refreshed GitHub workflow action pins.
• Removed the initial scaffold README and cleaned up formatting/ignore/export configuration.

Reviewed changes

Copilot reviewed 22 out of 26 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/phpstan/wp-cli-stubs.stub	Adds WP-CLI/PHPStan stub overrides.
SECURITY.md	Adds security disclosure guidance.
README-INITIAL.md	Removes stale initial scaffold documentation.
phpunit.xml.dist	Updates PHPUnit cache and coverage output settings.
phpstan.neon.dist	Updates PHPStan rules, paths, stubs, and scan files.
package.json	Updates Node/npm requirements, scripts, dev dependencies, and overrides.
includes/Abilities/DiscoverAbilitiesAbility.php	Adds PHPCS ignores for callback parameters.
docs/guides/testing.md	Updates testing guide commands for the new wp-env test config.
composer.lock	Updates Composer dependency lock state.
composer.json	Updates Composer dev dependencies and script names.
.wp-env.test.json	Adds dedicated wp-env test configuration.
.wp-env.json	Simplifies default wp-env development configuration.
.prettierrc.js	Applies Prettier formatting cleanup.
.prettierignore	Reorders ignored paths.
.phpcs.xml.dist	Updates PHPCS rules, compatibility baseline, and exclusions.
.nvmrc	Updates Node major version to 22.
.npmrc	Adds npm install policy defaults.
.gitignore	Refreshes ignored development, test, and build artifacts.
.github/workflows/test.yml	Updates CI action pins and test/lint commands.
.github/workflows/release.yml	Updates selected release workflow action pins.
.github/workflows/props-bot.yml	Updates comments and GitHub Script action pin.
.github/workflows/copilot-setup-steps.yml	Updates setup workflow action pins and Node setup.
.github/PULL_REQUEST_TEMPLATE.md	Adds a repository PR template.
.github/dependabot.yml	Adds Dependabot configuration for actions, Composer, and npm.
.gitattributes	Refreshes export-ignore and linguist attributes.

Comments suppressed due to low confidence (2)

docs/guides/testing.md:151

• This WP-CLI example is missing the container argument after run. It should invoke the cli container before --env-cwd; otherwise wp-env treats --env-cwd as the container name and the command fails.

- Run WP-CLI commands: `npm run wp-env:test run --env-cwd=wp-content/plugins/mcp-adapter/ YOUR_COMMAND`

.phpcs.xml.dist:50

• This raises the compatibility scan baseline to WordPress 6.9 while the project documentation still advertises support for WordPress 6.8 with the Abilities API plugin. PHPCS will no longer flag accidental 6.9-only API usage, so future changes can silently break the documented 6.8 support unless the support policy is updated everywhere.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[galatanovidiu]

Clean scaffold work. Dev/test wp-env split and PHPCS rename both read better 👍
Just a few comments.

[justlevine]

Note to self we may want to think about the GH repo configuration.

Remaining todos for followup PRs

• NPM v11 - chore: Update deps and cleanup scaffold (first pass) #185 (comment)
• Bump min WordPress version - chore: Update deps and cleanup scaffold (first pass) #185 (comment)