Isolate WP-CLI scalar captures from PHP diagnostic prefixes

[chubes4]

Related issues

Fixes #494

Related, not duplicated:

• --format=json stdout is corrupted by a PHP deprecation notice, so output is not parseable data-machine-code#1279 — DMC cannot intercept the notice; it is emitted during phar bootstrap before WordPress loads.
• Keep PHP diagnostics out of WP-CLI stdout Automattic/studio#4686 / #4731 — Studio WP-CLI launcher should route diagnostics to stderr.
• Bundled WP-CLI emits PHP 8.5 deprecations into command output Automattic/studio#4734 — bundled WP-CLI 2.12.0 phar still vendors react/promise v2.
• PHP 8.5 deprecation warning from bundled react/promise v2.x in phar wp-cli/wp-cli#6271 — closed; nightly is PHP 8.5-clean, latest stable is still 2.12.0.
• Plugin-only verification misparses WP-CLI diagnostic preambles #458 — plugin-only JSON verification, a different capture path.

How AI was used in this PR

OpenAI GPT-5.6 Sol via OpenCode general subagent investigated the PHP 8.5 react/promise deprecation across wp-coding-agents and Data Machine Code, searched existing trackers, identified the untracked scalar-capture gap, implemented the shared stdout isolator, added contaminated/normal fixtures, and opened this PR under human direction.

Proposed Changes

Upgrade detection treated raw WP-CLI stdout as machine values. On PHP 8.5, Studio's bundled wp-cli.phar prints a react/promise deprecation before the payload, so SITE_DOMAIN became Deprecated: ... localhost:8881 and recorded log paths were emptied after warning tokens were rejected as non-absolute paths.

This PR adds one capture helper in lib/common.sh and uses it for the two scalar readers that produced that failure: site URL detection and source-policy option reads. Host-runtime emission stays with Studio/WP-CLI; this defends the wp-coding-agents capture contract.

Testing

• bash tests/wp-cli-machine-output.sh
• bash tests/detect-site-domain.sh
• bash tests/source-mode.sh
• bash tests/owned-source-discovery.sh

The new suite covers normal scalar stdout, warning-contaminated stdout, diagnostic-only stdout, SITE_DOMAIN detection, and recorded log-path normalization.