feat: add internal WordPress cron runner

docs/security.md

@@ -11,6 +11,8 @@
   collections.
 - File editing is always disabled. Production also disables web-based core, theme, and
   plugin changes; patched images are rebuilt and redeployed instead.
+- The WordPress image removes the bundled Akismet and Hello Dolly plugins, and the
+  entrypoint also removes them from existing persistent volumes on startup.
 - XML-RPC and comments are disabled. NGINX blocks PHP execution below uploads, dotfiles,
   direct `wp-config.php` requests, the WordPress readme/license files, direct
   installation entry points, public mu-plugin directory probing, and external
@@ -28,7 +30,9 @@
   WordPress/Apache retains the capabilities needed by the official image internally,
   but no WordPress port is published. A containerized security test fails if the
   WordPress service is configured with host-published ports.
-- WP-CLI normally joins only the internal data network. The maintenance override
+- `wp-cron` runs WordPress scheduled events through WP-CLI on the internal data network
+  only; public `wp-cron.php` remains blocked. WP-CLI normally joins only the internal
+  data network. The maintenance override
   attaches WP-CLI to the web network for operator-triggered commands that require
   outbound internet access, such as WordPress core downloads; do not use it for routine
   bootstrap or inspection commands.