o2 Posting Access: Apply the pending review status on all post creation paths

[obenland]

The plugin grants non-members publish_posts, edit_posts and edit_published_posts so o2's front end renders its post form for them, and then holds their submissions for review. That second step is attached only to o2's own o2_create_post filter, so it applies to the front end editor but not to the other ways a post can be created.

Changes

• Move the status handling to wp_insert_post_data, which every creation path runs through. The filter only touches posts a logged-in user is authoring for themselves, so editorial, cron and WP-CLI inserts are left alone, and it exempts statuses that are not publicly visible so o2's auto-draft step is unaffected.
• Correct two checks in add_post_capabilities(). The in_array() short-circuit searched the values of a cap => bool map rather than its keys, so it never matched; and the guard consulted the current user rather than the user the filter was called for.

Tests

Adds a PHPUnit suite covering the plugin's posting access behaviour: the capability grant, user_can_publish() (including the moderation_keys and filter branches), the review status across creation paths, and how a post awaiting review is presented.

The suite runs as multisite. is_user_member_of_blog() returns true unconditionally when ! is_multisite(), which makes both the capability grant and user_can_publish() no-ops, so on single site the assertions would pass without exercising any of this code. WP_TESTS_MULTISITE is defined in the plugin's bootstrap rather than via wp-env's multisite option, which conflicts with the test suite's own network install.

Also adds a make wp-env environment for the make.wordpress.org plugins to run it in, and a matching CI job.

OK (32 tests, 43 assertions)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.