fix(release): package pinned php-wasm overlay

[chubes4]

Summary

• Replace the nested local .tgz dependency that npm excludes from packed packages with an unpacked local package directory.
• Stage and materialize the pinned overlay in CLI/plugin release artifacts instead of preserving a dangling staging symlink.
• Bind shipped contents to provenance with a deterministic tree SHA-256.
• Verify npm consumer install, standalone CLI, and WordPress plugin artifacts all contain the exact loadable overlay.

Closes #2275.

This unblocks the authorized WP Codebox 0.21.0 release, which previously stopped safely at test:release-package-coverage before creating a release commit or tag.

Verification

• npm install --no-audit --no-fund
• npm run test:release-package-coverage
• git diff --check

AI assistance

• Model: GPT-5.6 Sol
• Tools: OpenCode and Homeboy
• Used for: Release failure diagnosis, packaging implementation, review, and verification. Chris Huber remains responsible for every line.