role-capabilities-check: JS files out of sync with PHP schema #188

Problem

PR #183 changed the PHP backend for role-capabilities-check but did not update the corresponding JS files, which would silently break the ability:

Status mismatch

• PHP now returns status: 'escalated' instead of 'modified'
• role-capabilities-check.js (line 131-133) and check-if-hacked.js (line 295-296) both filter on r.status === 'modified', meaning escalated roles will never appear in the LLM interpretation or the workflow summary

Removed fields still referenced in JS

• role.removed is referenced in summarize (lines 70-72) and interpretResult (lines 142-148) but no longer exists in the PHP response
• result.extra_roles is referenced in both JS files but was removed from the PHP response

Security trade-off to discuss

Removing extra_roles detection means attacker-created roles (e.g., a custom "Support" role with manage_options) will no longer be flagged. This is one of the most common persistent backdoor vectors. Should this be split into a separate ability rather than removed entirely?

False positive concern

Any plugin adding custom capabilities to built-in roles (WooCommerce adding manage_woocommerce to administrator) will trigger an escalation warning. The new 'escalated' label is more alarming than the old 'modified' for what is typically benign plugin behavior.

Required changes

1. Update role-capabilities-check.js: change 'modified' filter to 'escalated', remove all removed and extra_roles references, update docblock
2. Update check-if-hacked.js: same status filter fix, remove stale extra_roles and removed references
3. Update PHP file-level docblock (line 7) to remove mention of "extra roles"
4. Discuss whether extra_roles detection should be a separate ability

Context

Discovered during review of PR #183. PR closed pending these fixes.