feat: forward dependency overlays in wordpress-multisite-e2e

[chubes4]

Problem

The generic wordpress-multisite-e2e rig forwards consumer plugins, themes, PHP/WordPress versions, steps, workloads, and browser scenarios, but it does not forward WP Codebox's existing inputs.dependency_overlays contract.

Roadie#87 mounts current standalone Agents API plus Data Machine. Data Machine's committed Composer vendor contains an older Agents API package. During Data Machine activation, Composer loads data-machine/vendor/wordpress/agents-api/agents-api.php, bypassing the standalone fixed checkout and reproducing the old PHP-WASM GLOB_BRACE fatal. Mount ordering cannot replace Composer-owned vendor files.

WP Codebox already owns the needed generic primitive:

{
  "inputs": {
    "dependency_overlays": [{
      "kind": "composer-package",
      "package": "automattic/agents-api",
      "source": "/absolute/immutable/checkout",
      "consumer": "data-machine",
      "metadata": {}
    }]
  }
}

Expected

Add one typed consumer setting, for example wp_codebox_dependency_overlays, validate it generically, and forward it unchanged into the rig recipe. Preserve source/package/consumer provenance in effective recipe evidence. Do not add a new overlay implementation or product knowledge.

Acceptance criteria

• Static tests prove valid overlay projection.
• Invalid non-array/entry shapes fail during rig check.
• A real integration replaces a bundled Composer package from an immutable checkout.
• No product names appear in generic rig code or fixtures.

Evidence

Homeboy run: 421d34b5-35b7-4af1-b1e7-95c07a124587

homeboy runs evidence 421d34b5-35b7-4af1-b1e7-95c07a124587
homeboy runs artifacts 421d34b5-35b7-4af1-b1e7-95c07a124587

AI disclosure

Diagnosed with openai/gpt-5.6-sol.