Harden Flexia and modernize the independent block theme for 3.2.0

[rupok]

Flexia no longer changes plugin activation or overrides ACF security policy during rendering. This update makes the independent block theme ready for a 3.2.0 review, fixes incorrect content/commerce templates, and replaces recursive packaging with an explicit release manifest.

Changes

• Preserve optional plugin policies, guard direct PHP entry, encode translated block JSON correctly, and replace remote icon requests.
• Fix the posts index, inherited archives/pagination, selected-post sidebar, catalog routing and related products; use native site identity/navigation.
• Modernize theme.json to v3 (WordPress 6.6 minimum), repair font references, add local WOFF2, share styles, and improve focus/touch/motion/contrast behavior.
• Add locked and audited WPCS 3.4.1 tooling, pinned CI actions, source/schema/packaging checks, and disposable WordPress/WooCommerce regressions.
• Document Core independence, per-site retirement, saved-template migrations, validation limits and rollback. No Core code is moved into the theme.

The commits separate security, templates, styles/fonts, build/test infrastructure, documentation and release preparation.

Validation

Hosted CI passes on the current head: PHP 7.4 / WordPress 6.6 and PHP 8.3 / current WordPress / WooCommerce. Run results.

• WordPress 6.6 and local core reporting 7.1, PHP 8.2.29: 585 assertions passed on each, including the extracted release ZIP.
• WooCommerce 11.0.1: catalog resolution, related/unrelated isolation and simple/variable/grouped/external product forms passed.
• Original-theme negative control fails ACF policy, plugin-state, translated JSON, archive-scope and sidebar regressions.
• PHP syntax, focused WPCS, locked dependency audit, 757 block declarations, three theme schemas and four packaging tests passed.
• Browser smoke checks covered posts/comments, catalog/product, add-to-cart, loaded cart, checkout form, default/dark/orange and a 320 px mobile menu. No order was submitted.

Rollout notes

Review docs/MIGRATION-3.2.md, docs/CORE-RETIREMENT.md and docs/IMPLEMENTATION-3.2.md. Existing database-saved templates can override these files. Fleet-wide Core removal, actual ACF/multisite/child customizations, full editor/accessibility/RTL acceptance, raster performance and payment-sandbox checks remain site-specific. A WooCommerce cart dependency warning was observed without preventing cart loading. Hosted CI covers PHP 7.4/8.3 separately; local checks do not claim those runs passed.

No production deployment or plugin repository deletion is included.

Final package

Flexia 3.2.0 is available with the installable ZIP, SHA-256 checksum and file manifest. The uploaded assets were downloaded and verified against clean release commit 40452ad1f9ccc88f40155c77990ea38455bc3fd1. Team acceptance testing precedes manual upload. This PR remains open; the GitHub release does not deploy websites or publish to WordPress.org.