chore: rely on homeboy wordpress extension for analysis toolchain

[chubes4]

Removes the duplicated WordPress analysis toolchain from require-dev and relies on Homeboy's wordpress extension, which already ships phpstan, phpstan-wordpress, the WordPress/WP-CLI stubs, php_codesniffer, wpcs, and phpunit. Follows the proven recipe from Extra-Chill/extrachill-users#411. Unblocks on Extra-Chill/homeboy-extensions#2849.

What changed

• composer.json — removed all of require-dev:
  • phpunit/phpunit (^9.6)
  • php-stubs/wordpress-stubs (^6.9)
  • wp-coding-standards/wpcs (^3.4.1)
  • phpcsstandards/phpcsutils (^1.2.3)
  • squizlabs/php_codesniffer (^3.13.6)
  • phpcompatibility/phpcompatibility-wp (^2.1)
• Removed config.allow-plugins — its only entry was dealerdirect/phpcodesniffer-composer-installer, which arrives transitively with the extension's wpcs.
• Repointed lint / lint-fix scripts from bare phpcs/phpcbf (resolved from the now-nonexistent local vendor/bin) to the extension's binaries via homeboy extension exec wordpress -- "$HOMEBOY_EXTENSION_PATH/vendor/bin/...", pinned to the extension's homeboy-wordpress-project ruleset so composer lint matches what homeboy review lint enforces in CI.
• composer.lock — regenerated with composer update --no-install (the stale-lock failure mode from extrachill-users#411). Lock packages-dev is now empty; no removed package remains as a locked package.

Judgment calls

• Removed two packages beyond the reference list — phpcsstandards/phpcsutils and phpcompatibility/phpcompatibility-wp were not in the extrachill-users removal list but are the same duplication: phpcsutils arrives transitively with the extension's wpcs, and nothing in this repo references the PHPCompatibilityWP ruleset (there is no phpcs.xml; grep confirms zero PHPCompatibility references). Keeping phpcompatibility-wp would have also kept a local phpcs requirement alive for an unused standard.
• require upgrades in the lock — lock regeneration re-resolved wordpress/agents-api (dev-main snapshot) and minor patch bumps of transitive prod deps. Expected consequence of regenerating rather than hand-editing the lock.

Not applicable here

• No phpstan.neon / phpstan.neon.dist in this repo (only phpstan-baseline.neon), so no szepeviktor extension.neon include to remove.
• No @phpstan-impure core-function stub file. The tests/fixtures/*-stubs.php files are runtime test doubles (function_exists-guarded shims for the pure-PHP phpunit smoke harness), not phpstan stubs — left untouched.

Verification

• composer.json parses (json.load).
• Lock regenerated; packages-dev empty; no banned packages in packages/packages-dev.
• No PHP files edited, so no php -l targets.