chore: add wp-cli maintenance override

docs/operations.md

@@ -23,6 +23,20 @@ Review security releases routinely, update pins in a task branch, rebuild, run t
 test suite, and deploy. Production disables WordPress web-based file modifications, so
 image rebuilds are the update path.
 
+The default `wp-cli` service is attached only to the internal data network. When a
+maintenance command must download from the internet, use
+`docker-compose.maintenance.yml` explicitly:
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.maintenance.yml --profile tools run --rm wp-cli -c 'wp core update --version=7.0.2 --force'
+docker compose -f docker-compose.yml -f docker-compose.maintenance.yml --profile tools run --rm wp-cli -c 'wp core update-db'
+docker compose --profile tools run --rm wp-cli -c 'wp core version'
+docker compose restart wordpress proxy
+```
+
+Do not use the maintenance override for routine bootstrap or inspection commands that
+do not need outbound network access.
+
 External `wp-cron.php` requests are blocked to reduce public attack surface. If future
 content scheduling, maintenance jobs, or plugin features require WordPress cron, run it
 from a controlled host/container cron against the private WordPress service instead of