fix(quality): clear the phpstan finding and phpcs errors before release

- class-webdecoy-updater.php: narrow the update-transient parameter to
  stdClass before writing $transient->response, which both types the
  dynamic property write for phpstan (level 3) and guards the non-object
  case WordPress can pass on a request's first run. Also initialise
  ->response as an array before the indexed assignment.
- phpcs.xml.dist: exclude the output-escaping sniff for tests/ only. The
  test harness is CLI: its echo output reaches a terminal, never a
  browser, so the sniff was a false positive (escaping would corrupt the
  terminal output). Every other security rule still applies to tests.

Author: cport1

includes/class-webdecoy-updater.php

@@ -37,6 +37,14 @@ public function __construct()
      */
     public function check_for_updates($transient)
     {
+        // WordPress passes the update transient (a stdClass) here, but on the
+        // first run of a request it can be a non-object (false). Narrowing to
+        // stdClass makes the dynamic ->response write below well-typed and
+        // guards the non-object case in one step.
+        if (!$transient instanceof \stdClass) {
+            return $transient;
+        }
+
         if (empty($transient->checked)) {
             return $transient;
         }
@@ -73,6 +81,10 @@ public function check_for_updates($transient)
                 return $transient;
             }
 
+            if (!isset($transient->response) || !is_array($transient->response)) {
+                $transient->response = [];
+            }
+
             $transient->response[WEBDECOY_PLUGIN_BASENAME] = (object) [
                 'slug' => 'webdecoy',
                 'plugin' => WEBDECOY_PLUGIN_BASENAME,

phpcs.xml.dist

@@ -25,6 +25,16 @@
     <!-- Escaping, sanitization, nonces, validated input -->
     <rule ref="WordPress.Security"/>
 
+    <!--
+        The test harness under tests/ is CLI-only: its echo output goes to a
+        terminal, never to a browser, so the output-escaping sniff is a false
+        positive there (escaping would corrupt the terminal output). Every
+        other security rule still applies to test code.
+    -->
+    <rule ref="WordPress.Security.EscapeOutput">
+        <exclude-pattern>tests/</exclude-pattern>
+    </rule>
+
     <!-- Proper use of $wpdb->prepare() -->
     <rule ref="WordPress.DB"/>