fix(runtime): align doctor and private kernel cache maintenance

[brianvarskonst]

Doctor and explicit cache maintenance selected the old default cache after Kernel 1.1.4 had moved to its private fallback. Diagnostics could pass an unusable explicit root, and cache clearing could leave the actual compiled generation untouched. Runtime 1.2.2 now selects the same cache/build generation, reports fallback selection and rejects unsafe explicit locations before any deletion.

Explicit external cache/build roots are supported with existing 0700 directories owned by the calling PHP identity, protected ancestors and no symlinks. Only the selected environment's kernel artifacts are cleared. Standalone checks also reject known public/core/content roots and an explicitly declared Doctor webroot without booting WordPress or creating directories. Kernel remains optional; installed versions must be at least 1.1.4.

Validation: full PHP 8.5 QA with real Kernel 1.1.4, WordPress 7.1.1, WP-CLI 2.12 and MariaDB: 1,400 tests / 10,212 assertions, zero skips. PHPCS, PHPStan, native Actionlint, documentation verification, three reusable-workflow interfaces and 12 Python tooling tests pass. Actual compiled-container fixtures cover private fallback, safe external roots, owner/permission/symlink failures, read-only Doctor behavior and preservation of other environments and assets. Four standalone layout/config regressions verify that unused Kernel locations do not fail diagnostics when Kernel is absent.

Deployment acceptance must still verify the actual PHP-FPM identity and namespace; CLI diagnostics cannot prove access by another user or service.