fix: generate native wp-config in the WordPress parent

[brianvarskonst]

Native Runtime now generates the main configuration directly in the WordPress Core parent. With Core in public/wp, the only fresh configuration is public/wp-config.php; there is no root configuration or forwarding loader. WP-CLI, section editing, setup drift and production diagnostics resolve the same target. Legacy profiles and explicit invocation-context targets retain their behavior.

Existing managed root configurations migrate without executing PHP or rotating literal authentication salts, including edited literal values. The original root file remains available for rollback. Edited managed sections, dynamic salts, location-dependent salt code and valid or dangling root symlinks require explicit migration before any configuration or payload is replaced. ADR 0029 documents the location change and migration procedure.

The real package-installation and documented-example checks now verify the public main configuration and the absence of a root file or proxy. Consumer replay monitors both native and retained root configurations. The privileged bootstrap test verifies the actual public configuration with separate PHP identities.

Validation:

• Full composer qa: 1,439 tests, 10,449 assertions, zero skipped tests; coding standards and static analysis passed.
• Five added migration regression cases, including salt preservation and refusal before writes.
• Real WordPress and isolated MariaDB bootstrap passed through the standard parent lookup.
• Real WPackagist/Core installations passed both with Composer plugins and with plugins disabled; repeated setup preserves generated artifacts.
• Documented installation/custom-step example and shared-group access tests passed.
• Documentation validation, 14 Python tooling tests and all 408 executed parity rows passed.

[brianvarskonst]

Review completed on c21ed87ce90b93dcf70d7d9a3010d3f87172a076.

Resolved findings:

• The installation pipeline still read the root wp-config.php. Updated the real package installer, documentation example, consumer replay and privileged permission test to use or monitor the native Core-parent configuration. Both formerly failing WPackagist jobs now pass.
• Native migration followed in-project root symlinks and treated dangling links as absent, allowing configuration replacement without an explicit migration. Both cases now fail before writes, with regression coverage preserving the source file, link, public proxy and payload artifacts.
• A retained KEYS section could contain __DIR__ or __FILE__ and silently change behavior when moved. Migration now refuses this code before writes. Edited literal salts still survive migration.

Local validation passed: coding standards, static analysis, 1,439 PHPUnit tests / 10,449 assertions with zero skips, real WordPress/MariaDB bootstrap, real Composer installs in both plugin modes, documented examples, privileged access checks, 14 Python tests, documentation validation and all 408 parity rows.

No unresolved findings remain in the reviewed changes.