Minify frontend/admin assets as an optional release build

[Castellon-ACM]

Summary

• Adds bin/build-assets.js, a small Node script (no bundler) that uses terser (JS) and clean-css (CSS) to produce .min.js/.min.css build artifacts for assets/cookie-notice/frontconsent-cookie-notice.js/.css and assets/admin/settings.js/.css.
• CookieNotice::get_asset_url() and Settings::get_asset_url() enqueue the .min.* file when SCRIPT_DEBUG is off (undefined or false) and the file exists on disk, mirroring WordPress core's own suffix convention — otherwise they fall back to the plain file.
• The plain, hand-commented files remain the source of truth; contributors keep editing them directly, exactly as AGENTS.md's "no build step" policy already states (amended with one clarifying sentence about the new optional release step).
• .min.js/.min.css are gitignored — they're never committed to main, never required for local dev, and a fresh checkout that hasn't run the build simply falls back to the plain files (verified by tests).
• Added npm run build as an optional local script, plus npm run test:build-assets (also covered by npm run test:js) smoke-testing the minifiers against the real source files: non-empty output, syntactically valid (new vm.Script(...)), and still containing a few behavior-relevant tokens/selectors.
• Added PHPUnit tests (tests/Unit/CookieNoticeAssetMinificationTest.php, tests/Unit/SettingsAssetMinificationTest.php) covering: minified file preferred when present and SCRIPT_DEBUG is off, plain file used when the minified file is absent, and plain file forced when SCRIPT_DEBUG is on even if a minified file exists (run in a separate process so the constant doesn't leak into other tests).

Manual follow-up needed: .github/workflows/deploy.yml

The push token available to this automation lacks the workflow OAuth scope GitHub requires to update workflow files, so the actual CI wiring couldn't be pushed on this branch. Please apply this diff by hand (or ask me to redo it with proper scope) before merging, so tagged releases actually ship the minified assets:

     - name: Build
       run: composer install -o --no-dev --ignore-platform-reqs
 
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+
+    - name: Install npm dependencies
+      run: npm ci
+
+    - name: Build minified assets
+      run: npm run build
+
     - name: WordPress Plugin Deploy
       uses: 10up/action-wordpress-plugin-deploy@stable

Insert it right after the existing - name: Build (composer install) step, before - name: WordPress Plugin Deploy, in .github/workflows/deploy.yml. .distignore already excludes bin/, node_modules/, and package.json/package-lock.json from the SVN package, and does not exclude *.min.*, so the generated files ship correctly once this step runs.

Test plan

• composer lint — passes
• composer phpstan — passes ("No errors")
• npm run test:js (25 tests, includes new build-assets.test.js) — all pass
• npm run build — verified it produces valid .min.js/.min.css (checked with node --check and manual inspection), then removed the artifacts again since they're gitignored dev-only output
• composer test (PHPUnit) — not run in this sandbox: no MySQL/MariaDB or Docker available to stand up the WordPress test database (bin/install-wp-tests.sh requires it). The new tests follow the existing Yoast\WPTestUtils\WPIntegration\TestCase pattern exactly (see tests/Unit/CookieNoticePolicyPageTest.php) and were verified for syntax (php -l) and logic by hand; please run composer test in CI/locally to confirm.

Closes #4.

🤖 Generated with Claude Code