feat: add internal WordPress cron runner

docs/runbook.md

@@ -50,6 +50,39 @@ docker compose restart wordpress proxy
 If DNS still fails with the maintenance override, inspect the host/container DNS
 configuration and firewall rules before retrying the update.
 
+## Scheduled WordPress events are late
+
+The public `/wp-cron.php` trigger is intentionally blocked. Scheduled jobs are executed
+by the internal `wp-cron` service.
+
+1. Confirm the runner is present:
+
+   ```bash
+   docker compose ps wp-cron
+   ```
+
+2. Inspect due events:
+
+   ```bash
+   docker compose --profile tools run --rm wp-cli -c 'wp cron event list'
+   ```
+
+3. Inspect runner logs without printing `.env` values:
+
+   ```bash
+   docker compose logs --tail=100 wp-cron wordpress db
+   ```
+
+4. If needed, run due events manually:
+
+   ```bash
+   docker compose --profile tools run --rm wp-cli -c 'wp cron event run --due-now'
+   ```
+
+The Site Health loopback test may still report a blocked public loopback while the edge
+continues to deny `/wp-cron.php`; that is an expected trade-off of the hardened public
+configuration.
+
 ## Uploaded image does not appear on the public page
 
 1. Confirm the image was selected in **Appearance > Customize**, not only uploaded in