Add a core/comments-query ability #1064

Split out from #40, as requested there on 2026-07-16.

What problem does this address?

Comments are the third resource the 7.2 roadmap names for read-only coverage, and the plugin already has a consumer waiting for it: the Suggest Reply feature (#508) reads comments through its own code path rather than an ability. A core/read-comments ability gives Suggest Reply, the AI Workspace, and MCP clients one permission-checked way to fetch a comment or a thread.

Proposal

• Name: core/comments-query
• Category: content
• Input: id (single comment) or list arguments: post, parent (thread), status (approve by default; hold, spam, trash, all gated by moderate_comments), type, author, author_email (gated), search, after/before, per_page, page, orderby, order. Returns total and total_pages.
• Output per item: id, post id, parent, author display name, author id when present, date, content (rendered and raw for moderators only), status, type, link, and registered show_in_rest meta. Author email and IP only for users with moderate_comments, matching REST's context handling.
• Permission: mirror WP_REST_Comments_Controller: approved comments on readable posts for anyone who can read the post; anything unapproved, or any private field, requires moderate_comments/edit_comment.
• Annotations: readonly: true, idempotent: true, destructive: false.

Out of scope: replying, approving, or deleting (core/manage-comments, separate issue). Suggest Reply keeps its current path until this lands; migrating it is a follow-up.

Acceptance

• Tests for: approved-only default, status=hold denied to a subscriber and allowed to an editor, private fields stripped for non-moderators, thread fetch by parent, comments on a private post hidden, pagination totals.
• Abilities Explorer and MCP Adapter exposure verified.
• WordPress Core Abilities #40 checklist updated.

Path to core

Prototype here; Trac ticket after the shape settles.