Test isolation: shared base, Commands_Test isolation, real Services_Test (#14, #15)

[akshat009]

Re-audit #2 follow-ups.

#14 — static state was leaking between tests

• tests/Unit/Plugin_TestCase (abstract, ships in every scaffold): tearDown() calls Services::reset() + Plugin::set_instance( null ). Every generated *_Test.php now extends Plugin_TestCase instead of PHPUnit's TestCase.
• Commands_Test gets @runInSeparateProcess / @preserveGlobalState disabled — its define( 'WP_CLI', true ) can no longer persist into later tests. Schema_Test's front-end-gate test drops its markTestSkipped guard, so the Test isolation: shared base, Commands_Test isolation, real Services_Test (#14, #15) #13 fix is verified on every run again.

#15 — Services_Test didn't test the contract

Was assertTrue($ref->isStatic()) + ReflectionProperty into a private array (because set( object ) couldn't feed a \stdClass through a typed accessor). Now generated per-accessor from addService():

$a = $this->createMock( \Ns\Cache\Cache_Service::class );   // satisfies the return type
Services::set( 'cache', $a );
$this->assertSame( $a, Services::cache() );
$this->assertSame( Services::cache(), Services::cache() );     // memoisation
Services::reset();
// ... a fresh double comes back after reset()

Services_Test ships only when there's >= 1 accessor.

#11 / #12 revised (from the audit's own retractions)

• templates/ phpcs: the blanket */templates/* exclude is justified (the audit retracted "drop it"), but it over-suppressed EscapeOutput on the HTML email template. Now, when a woo:email / woo:my-account module ships templates/, phpcs.xml adds <file>./templates</file> and excludes only PrefixAllGlobals for */templates/* and EscapeOutput for */templates/emails/plain/*. Gated on has_wc_template_overrides.
• composer prepare-dist = composer install --no-dev --optimize-autoloader, so plugin-zip doesn't depend on reading the release docs.

Not in this PR

• ci: add self-consumption job (ubuntu + macos) #4 (uniform init_hooks() contract test across 22 modules) — bigger, separate.
• ci(publish): upgrade npm CLI before publish (Trusted Publishing needs >=11.5.1) #7 (provider filter) — design call, no defect.

Verified: 69 generator + 13 engine tests; full/minimal scaffolds php -l clean, valid phpcs.xml both ways, every unit test extends Plugin_TestCase.