fix: actually show the rejection message instead of GF's generic banner

[oxyc]

The bug

The message this plugin sets when it rejects a submission was never rendered.

validate() wrote it to $form['validation_summary_message'] — but Gravity Forms only reads that as a field context property (form_display.php:5685), never off the form array. $form['failed_validation_page'] was dead the same way: GF tracks the failed page through a by-reference parameter on validate(), not a form key. Both lines looked functional and did nothing.

What visitors actually saw was GF's unconditional fallback (form_display.php:5622):

There was a problem with your submission. Please review the fields below.

There are no fields to review — an ALTCHA rejection highlights nothing. So the banner instructs people to hunt for a broken field that doesn't exist, and whichever fields look most suspicious take the blame.

That isn't hypothetical. This is exactly how the recent expiry bug on the Snellman consumer-service forms got misdiagnosed as a produkt-field problem, costing a round of investigation into conditional logic that turned out to be entirely correct.

The fix

Hook gform_validation_message (filterable at form_display.php:5636) so the message reaches the DOM, and delete the two dead assignments.

• Scoped to our own rejections. Only forms rejected in this request are affected; ordinary field errors keep GF's wording. Telling someone with a missing email address to reload the page would be worse than useless.
• Per-form. Two forms on a page — rejecting one doesn't rewrite the other's banner.
• Markup mirrors GF's, including deriving hide_summary from the form's own validationSummary setting rather than hardcoding it, so an admin's choice isn't overridden and GF's list-appending logic stays consistent. Existing theme styling applies unchanged.

The message itself is unchanged and still filterable via genero/gravityforms_altcha/error_message. It names the actual recovery action — reload and try again — which is correct for every rejection reason we produce.

Verification

End-to-end against a real GF submission:

BEFORE any rejection      → GF default, untouched
AFTER an ALTCHA rejection → "Sorry, your submission could not be verified.
                             Please reload the page and try again."
A DIFFERENT form          → GF default, untouched

4 new tests driving the real validate() reject path rather than a hand-set flag. 67/67 pass, pint --test clean.

Also adds a GFAddOn shell to the CI bootstrap — anything exercising shouldProtect() pulls in Settings, which extends it. Deliberately inert, so tests force protection through the documented should_protect filter instead of leaning on stub return values.

🤖 Generated with Claude Code