CI New Capabilities & Build Artifact Enforcement

[aryanjasala]

Context

After the bug fixes in TASK-010, CI still lacks several important capabilities: PHPStan, accessibility checks, and enforcement that build artifacts are never committed to git. This task adds all of them via a new reusable workflow.

Expected Outcome

A new reusable workflow .github/workflows/rtcamp-standard.yml that any project can call:

New CI jobs:

Job	What it does
PHPStan	Runs composer phpstan — fails on new errors
Pa11y	Crawls core template pages and checks WCAG AA
Build artifact gate	Fails if any file in assets/build/ is staged in the PR
Node caching	Caches node_modules across all jobs

Build artifact enforcement:

• assets/build/ added to .gitignore
• CI gate blocks any PR that includes committed build artifacts
• Build is generated by CI on merge, not committed manually

Acceptance Criteria

• .github/workflows/rtcamp-standard.yml created as a reusable workflow
• PHPStan job runs and fails on new errors (uses phpstan-baseline.neon from TASK-003)
• Pa11y checks core template pages against WCAG AA
• Build artifact gate blocks PRs that commit files under assets/build/
• assets/build/ added to .gitignore
• All action versions pinned to a specific tag or SHA
• All new jobs pass on a clean branch

Notes

• Playwright visual regression evaluation is out of scope for this task — decide separately.
• Pa11y runs against a live wp-env instance; ensure the environment is spun up in CI before the check runs.