ci: add workflow_dispatch trigger to phpunit.yml

[Copilot]

The nightly CI failed on two consecutive nights due to test bugs in ExitPathTest and ChallengeTest — wrong constructor call (Challenge(new Sudo_Session(), $stash) vs. Challenge($stash)), off-by-one lockout loop, and stale expires_at assertion. Those test fixes are already merged to main; all 19 CI jobs now pass.

Changes

• workflow_dispatch trigger added to phpunit.yml — enables manual re-runs of the full matrix (unit + integration + code quality) from the Actions tab without waiting for the 3 AM UTC schedule
• notify-on-failure condition extended from schedule-only to schedule || workflow_dispatch — manual re-runs that fail still create a GitHub issue and fire the Slack alert

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

🎮 Try in WordPress Playground

Open this PR in Playground →

Logs in as admin / password and installs the plugin from this PR's commit.

✅ What you can test

Feature	Notes
Plugin activation & settings page	✅
Gate fires on dangerous actions (plugin activate/delete, user delete, etc.)	✅
Challenge / reauthentication page	✅
Password verification & session cookie	✅
Admin bar countdown timer	✅
Request stash & replay after auth	✅
Rate limiting / 5-attempt lockout	✅ within session
Session expiry by time	✅ wait out the configured duration (1–15 min)
Two Factor plugin (TOTP)	✅ installed automatically via blueprint
unfiltered_html removed from Editor role	✅

❌ What won't work

Feature	Why
WP-CLI / Cron entry point policies	No CLI in browser
REST / XML-RPC entry point policies	Network disabled in Playground
Two Factor email / magic-link providers	PHP outbound network is off
Multisite behaviour	Single-site only
State after refreshing Playground	Full reset on page reload

Transients and user meta persist across normal WP navigation within
a session, but are wiped if you reload the Playground page itself.
Use the integration test suite to verify
transient TTL, real bcrypt, and multisite isolation.