feat: add internal WordPress cron runner

tests/security/check-compose.sh

@@ -27,6 +27,26 @@ grep -q '^FROM wordpress:7\.0\.2-php8\.3-apache$' /workspace/wordpress/Dockerfil
     exit 1
 }
 
+grep -q 'wp-content/plugins/akismet' /workspace/wordpress/Dockerfile || {
+    echo "The WordPress image must remove the bundled Akismet plugin." >&2
+    exit 1
+}
+
+grep -q 'wp-content/plugins/hello.php' /workspace/wordpress/Dockerfile || {
+    echo "The WordPress image must remove the bundled Hello Dolly plugin." >&2
+    exit 1
+}
+
+grep -q 'wp-content/plugins/akismet' /workspace/wordpress/entrypoint-wrapper.sh || {
+    echo "The WordPress entrypoint must remove Akismet from existing persistent volumes." >&2
+    exit 1
+}
+
+grep -q 'wp-content/plugins/hello.php' /workspace/wordpress/entrypoint-wrapper.sh || {
+    echo "The WordPress entrypoint must remove Hello Dolly from existing persistent volumes." >&2
+    exit 1
+}
+
 grep -q 'wp-content/(uploads|files)' /workspace/wordpress/apache-hardening.conf || {
     echo "Apache hardening must block PHP execution below uploads/files." >&2
     exit 1
@@ -76,3 +96,57 @@ grep -q "^[[:space:]]*-[[:space:]]*web$" /workspace/docker-compose.maintenance.y
     echo "The maintenance wp-cli service must explicitly opt into the web network." >&2
     exit 1
 }
+
+grep -Eq "^[[:space:]]{2}wp-cron:" "$compose_file" || {
+    echo "Compose must define an internal wp-cron service." >&2
+    exit 1
+}
+
+grep -q "wp cron event run --due-now" /workspace/wp-cli/cron.sh || {
+    echo "The wp-cron runner must execute due WordPress cron events via WP-CLI." >&2
+    exit 1
+}
+
+awk '
+    /^  wp-cron:/ {
+        in_wp_cron = 1
+        has_data_network = 0
+        has_db_host = 0
+        next
+    }
+    in_wp_cron && /^  [A-Za-z0-9_-]+:/ {
+        if (!has_data_network) {
+            print "The wp-cron service must join the internal data network." > "/dev/stderr"
+            exit 1
+        }
+        if (!has_db_host) {
+            print "The wp-cron service must receive WordPress database environment variables." > "/dev/stderr"
+            exit 1
+        }
+        in_wp_cron = 0
+    }
+    in_wp_cron && /^    ports:/ {
+        print "The wp-cron service must not publish host ports." > "/dev/stderr"
+        exit 1
+    }
+    in_wp_cron && /^[[:space:]]+WORDPRESS_DB_HOST:/ {
+        has_db_host = 1
+    }
+    in_wp_cron && /^      - data$/ {
+        has_data_network = 1
+    }
+    in_wp_cron && /^      - web$/ {
+        print "The wp-cron service must not join the public web network." > "/dev/stderr"
+        exit 1
+    }
+    END {
+        if (in_wp_cron && !has_data_network) {
+            print "The wp-cron service must join the internal data network." > "/dev/stderr"
+            exit 1
+        }
+        if (in_wp_cron && !has_db_host) {
+            print "The wp-cron service must receive WordPress database environment variables." > "/dev/stderr"
+            exit 1
+        }
+    }
+' "$compose_file"