Allow maintenance callers to require PR publication

[chubes4]

Closes #149

Evidence

• Source relationship: one committed candidate (3971d4232614cc18509ff14f73d3a72ceb5983cc) directly atop origin/main (37d2c492).
• Change kind: consumer workflow contract, deterministic contract coverage, and consumer documentation only.
• Scope: resolves success_requires_pr from the immutable lane default OR caller require_pr, forwards that resolved value to the portable runner recipe, reusable WP Codebox input, public workflow output, and dynamic publication projection.
• Runtime boundary: no runner or package/runtime behavior changed. The change only supplies the existing WP Codebox success_requires_pr input and uses its established target-repository publication contract, so it is no broader than issue Allow consumers to require a PR from maintenance runs #149.
• Verification capability: the repository validation suite was run locally against the pinned WP Codebox v0.12.23 producer and Agents API revision.

Contract

• Bootstrap always requires a valid target-repository PR.
• Maintenance permits a legitimate no-op by default.
• require_pr: true makes maintenance fail without a valid target-repository PR publication.
• Deterministic cases cover maintenance default, maintenance required, bootstrap default, and bootstrap with require_pr.

Tests

1. Run php tests/validate-docs-agent-packages.php.
2. Run php tests/validate-external-native-package-sources.php.
3. Run php tests/repair-docs-links-smoke.php.
4. Clone Automattic/agents-api at 78e2dd409010f98fa4d26cdd72572117384ab18d, then run AGENTS_API_DIR=/path/to/agents-api php tests/native-agent-import.php.
5. Clone Automattic/wp-codebox at v0.12.23, then run WP_CODEBOX_DIR=/path/to/wp-codebox php tests/validate-wp-codebox-run-agent-task-contract.php.
6. Run actionlint .github/workflows/*.yml.
7. Run git diff --check origin/main...HEAD.

AI Disclosure

Prepared and reviewed with OpenCode using openai/gpt-5.6-terra and openai/gpt-5.6-sol.