add: backend dependency readiness probe + bundled-vs-released audit

[kraftbj]

Foundation for the bundled-backends migration (sdd/bundled-backends-migration/, umbrella DOTCOM-16826, step 1 DOTCOM-17180).

What this PR ships

• src/class-backend-readiness.php — pure-read probe that reports each backend's status (ok / missing / too_old / incompatible), source (bundled / standalone / none), installed version, and required minimum. No hooks registered, no options written, no loader changes.
• tests/php/Backend_ReadinessTest.php — 7 unit tests covering the version-comparison + source-detection logic.
• audits/2026-05-20-backend-dependency-delta.md — the analysis: bundled commit identity for each backend, what we'd lose by switching to today's released versions, why the dependency-header cutover is still blocked on the next ActivityPub release.
• sdd/bundled-backends-migration/ — frontmatter flipped from planning → in-progress; review task 4 (backend compatibility gates) marked done with anchors in this PR.
• sdd/roadmap.md — moved from "In flight" to "On trunk", with the sub-issue range linked.

What this PR does not do

• Does not add Requires Plugins: activitypub, atmosphere to fosse.php.
• Does not change the bundled-vs-standalone load decision in fosse.php.
• Does not remove bundled/.
• Does not wire the readiness probe into admin UX (Status page, setup wizard, admin notices) — that's DOTCOM-17181.
• Does not change test fixtures off bundled/ — that's DOTCOM-17182.

The bundled load path short-circuits the version comparison, so today's production behavior is unchanged: every install loads bundled (current code matches bundled/), readiness reports ok for both backends.

Minimum-version anchors

• Backend_Readiness::MIN_ATMOSPHERE_VERSION = '1.1.0' — released version containing the atmosphere_post_embed filter (Automattic/wordpress-atmosphere PR 72) that FOSSE's Photo_Post_Atmosphere projects through.
• Backend_Readiness::MIN_ACTIVITYPUB_VERSION = '8.4.0' — forward-pointer placeholder. The released AP 8.3.0 lacks the toot:blurhash JSON-LD @context term (Automattic/wordpress-activitypub PR 3327) that FOSSE's Blurhash injector relies on. Bump this constant to the real number once that release tags.

The constants live in one place so each bump is a one-line change as upstream tags.

Why "fail today's released versions" is the right shape

This PR adds the readiness reporting before anything reads it for gating. Setting the AP anchor at the future-correct release number from day one means:

1. The audit doc (audits/2026-05-20-backend-dependency-delta.md) and the constants tell the same story.
2. When DOTCOM-17181 wires the probe into Status / admin notices, the message is accurate from launch — "AP 8.3.0 is installed but not compatible with FOSSE yet" — rather than first lying ("ok") then flipping later.
3. The dependency-header cutover (DOTCOM-17184) blocks itself naturally: it can't ship until the AP anchor is bumped to a real, released version.

Testing

composer run-script lint-php           # PHPCS clean on changes
composer run-script test-php           # 757 / 757 OK (Backend_ReadinessTest: 7 new)
pnpm run format:check                  # Prettier clean

No JS changes, no e2e changes.

Linear

• Umbrella: DOTCOM-16826 "Plan migration off bundled-backends bootstrap" (now has 8 sub-issues, DOTCOM-17180 → 17187).
• This PR: DOTCOM-17180 "Add runtime backend dependency readiness checks".