feat: add modern WP API scaffolds, enum-constrained inputs

[Adi-ty]

What this PR does

Adds the three remaining modern-WP-API scaffolds — wp/block-interactive, wp-api/block-bindings, wp-api/script-module — each no-op below the WP release that introduced its API, plus enum-constrained scaffold inputs.

Closes

Closes rtcamp/wp-devtools#61

Changes

• wp/block-interactive — Interactivity API block: block.json (supports.interactivity, viewScriptModule), render.php directives, view.js store, registrar. Reuses the wp/block-dynamic Blocks anchor.
• wp-api/block-bindings — Block Bindings source with core's exact get_value_callback signature and a post-meta lookup.
• wp-api/script-module — Script Module; registers only once the build output exists, so a clean checkout never ships a 404 <script type="module"> tag.
• Engine — inputs may declare enum; resolved values are checked post-transform and rejected with EINVALIDINPUT carrying invalid[] = { key, value, allowed }. wp-api/speculation pins mode/eagerness with it.
• Docs, CHANGELOG, scaffold SKILL + evals updated for the three scaffolds.

How I verified

npm run check — 706 tests, 50 suites, lint clean. wp-tooling validate — 38/38. Rendered into a real plugin under wp-env: PHPCS rtCampWP and PHPStan clean, generated PHPUnit green (script-module green both with and without a build). Scaffold skill evals: 46/46.

Acceptance criteria

• All three scaffolds render their full layout and wire into the correct module/anchor (bundled-manifests.test.js, including a non-includes/ PSR-4 root)
• Each no-ops below its API floor
• mode/eagerness validated against the byte-exact enum core accepts
• Lint, static analysis, 706/706 tests
• CHANGELOG entry under ## Unreleased

Reviewer notes

• Script-module URL derivation is intentionally one dirname() shallower than the path derivation: plugin_dir_url() returns the directory holding the file you pass it, so dirname( __DIR__ ) yields the plugin root. Using dirname( __DIR__, 2 ) there resolves to /plugins/<build_dir>/… and 404s every request. Documented on get_module_url(); the test asserts the URL stays inside the plugin directory.
• Constrained inputs are validated post-transform, on the resolved value that actually reaches the templates (src/scaffolds/registry.js:1080), so a manifest pins what renders rather than what the caller typed. Deliberate — flag it in review if you'd rather validate the raw supplied value.