refactor: ability manifest as single source of truth (v0.11 PR 1/4) - #191

Removes the first batch of parked features per the v1 Roadmap doc:
features deemed low-comeback-probability that don't merit code preservation.

Deleted:
  - backup-check (low accuracy — guesses backup plugins by slug)
  - opcode-cache-status (niche, most admins don't care)
  - disk-usage (nice-to-have, not essential)
  - core-editor-blocks (orphaned, only useful if content-generate exists)

Total: 7 files removed (3 PHP + 4 JS), ~860 lines of source code.

Manifest updates:
  - Removed entries from PHP and JS labs manifests
  - Updated manifest.test.js expected labs slug set
  - Removed bundle references in ability-bundles.js (3 bundles cleaned)
  - Removed test cases in core-abilities.test.js (3 abilities)
  - Replaced disk-usage in issue-158.test.js with theme-list
  - Removed Disk usage e2e conversation test

Git history preserves the deleted code (recoverable via
`git show v0.10.0:includes/abilities/backup-check.php` etc.) for any
future need to consult the implementation.

Tests: 117 passing, 0 changed. Build succeeds.
Lint: clean (PHP + JS + Prettier).

Roadmap context:
  - PR #191: manifest pattern (merged)
  - PR #192: voice out of default build (merged)
  - PR 3a (this): delete 4 simple abilities
  - PR 3b (next): delete webmcp-bridge
  - PR 3c (after): delete feedback system
  - PR 4 (last): flip default to core+local-only; labs requires
    WP_AGENTIC_ADMIN_ENABLE_LABS

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Last piece of the v0.11 strip-down. Labs (parked) abilities now require
opt-in to be registered, completing the WordPress.org submission path.

PHP — includes/abilities-manifest.php:
  resolve_enabled_abilities() now gates the labs array on the
  WP_AGENTIC_ADMIN_ENABLE_LABS constant. The wp_agentic_admin_enabled_abilities
  filter remains the per-ability override path:

    define( 'WP_AGENTIC_ADMIN_ENABLE_LABS', true );        // all labs
    add_filter( 'wp_agentic_admin_enabled_abilities', ... ); // selective

  New helper: wp_agentic_admin_labs_enabled() — single source of truth
  for the boolean.

PHP — includes/class-admin-page.php:
  Localizes two new fields on window.wpAgenticAdmin:
    - enabledAbilities: PHP-resolved slug list (the result of the
      filter above)
    - enableLabs: bool, mirrors wp_agentic_admin_labs_enabled()

  PHP becomes authoritative for which PHP-backed abilities the JS
  manifest registers.

JS — src/extensions/abilities/manifest.js:
  New JS_ONLY_ABILITIES set captures the slugs that have no PHP
  register function (current-user-role, core-site-info, core-environment-info,
  codebase-index, code-search, wp-config-list, content-generate).
  PHP's enabledAbilities list can't include these, so JS adds them
  back. Members that are also LABS are gated by enableLabs.

JS — src/extensions/abilities/index.js:
  registerAllAbilities() now delegates slug resolution to a new
  exported resolveEnabledSlugs() function:
    - With PHP-localized enabledAbilities: register that list ∪
      (JS_ONLY_ABILITIES minus labs-when-off)
    - Without (tests / dev): register all REGISTRARS minus LABS
      unless enableLabs is set

  Falls back gracefully when window.wpAgenticAdmin is unset, so
  Jest tests don't have to mock the global.

Tests:
  - manifest.test.js: 2 new cases covering JS_ONLY_ABILITIES contract
  - index.test.js (new file, 6 cases): PHP-authoritative path with
    labs on/off, empty PHP list edge case, fallback path with and
    without enableLabs

PHP smoke verification (manual):
  Without constant: 33 abilities resolved (CORE + LOCAL_ONLY)
  With constant:    39 abilities resolved (+6 labs)

Tests: 124 passing (was 117, +7 new).
Build: clean.
Lint: clean (PHP + JS + Prettier).

Roadmap context — END OF v0.11 STRIP-DOWN:
  - PR #191: manifest pattern ✅ merged
  - PR #192: voice out of default build ✅ merged
  - PR #193: delete 4 simple abilities (open)
  - PR #194: delete webmcp-bridge (open)
  - PR #195: delete feedback system (open)
  - PR 4 (this): flip default to core+local-only

After all six merge: ~3,800 LoC removed, 819 KB shipped bundle
dropped, 35 PHP abilities registered by default (down from 39),
plugin ready for WP.org submission (modulo the remaining 6 security
+ 6 compliance issues from the roadmap).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>