wordpress/webproject: do not report failed checks as "up to date"

[staude]

Problem

When wp-cli fails for a WordPress site (or a package manager fails for a web project), the checker records the error in CheckResult.Error but still sets the summary to "all sites are up to date". Notifiers and dashboards (Update Wall, Slack summaries) show the summary prominently and the error only as a secondary field — so a broken check looks like a healthy one.

Real-world example: on two of our servers the WordPress watcher failed on every run with sudo: a password is required (missing sudoers rule for wp as www-data), and for months the dashboard reported both sites as up to date.

Change

• checker/wordpress: track which sites failed and reflect that in the summary:
  • check failed for all 4 sites
  • 3 of 4 sites up to date, check failed for 1
  • 5 updates across 4 sites, check failed for 2
• checker/webproject: same treatment per project (kept the existing security-count wording).
• Summary building factored into a buildSummary helper in both packages, with table-driven tests.

CheckResult.Error is unchanged, so existing consumers keep the full error text.

Tests

go vet and go test ./checker/wordpress/ ./checker/webproject/ ./checker/ ./runner/ pass (run in a golang:1.25 container).

🤖 Generated with Claude Code

[staude]

Verified on a real host (Ubuntu 24.04, 4 WordPress sites, wp-cli via run_as: www-data), binary built from this branch, run with --notify=false:

• config with one site pointing to a non-existent path → WORDPRESS — 14 updates across 4 sites, check failed for 1, error text unchanged in the WARNING line
• same config with release 0.23.0 → WORDPRESS — 14 updates across 4 sites (failure invisible in the summary)
• unmodified config with this branch → WORDPRESS — 19 updates across 4 sites (no behaviour change when nothing fails)