fix(updates): major WordPress releases need Saddle's own setting (#359)

[ifahimreza]

Closes #359. On Fahim's "fix major release issue what best fit and release 1.5.2".

Why

update-core (#357) applied a major release when WordPress's own "automatic updates for all new versions" switch was on. WordPress turns that switch on for every site installed since 5.6, so on most sites an app could apply a major release the owner never chose to allow. The switch also answers a different question: what WordPress does on its own, unattended. An update through Saddle is attended (preview, then confirm), like the "Update to version" button in Dashboard → Updates, which ignores that switch.

What

• New setting: Major WordPress releases, the fourth switch under Saddle → Settings → Safety. Off by default, saved the moment it is flipped (POST /preferences, owner only), like the other three. Its id is the address an app hands the owner when it is refused (#saddle-field-saddle-core_major_updates). One setter, Saddle_Offer_Runner::set_core_majors(), for the switch and the settings registry (field control: custom, so no generic form draws it twice).
• No tool can turn it on. Core fields are agent: read (update-module-settings refuses with saddle_setting_owner_only), update-option only writes its allowlist, and the option saddle_core_major_updates is on Saddle_Settings_Guard::PROTECTED_OPTIONS, so a module's setter that touches it is put back.
• update-core applies a major only when it is on, whatever WordPress's own switch says. Minor and security releases are unchanged. When both are offered, the minor still comes first.
• The runner checks again when the run starts. If the owner turns the setting off after the confirm, the item is skipped, core is never asked, and the activity log says why.
• Copy updated: tool description, the refusal (names Saddle → Settings and Dashboard → Updates), the context line, readme feature bullet and 1.5.2 changelog line, the CLAUDE.md hard line, ROADMAP. .pot regenerated.

Visible change

Yes: a fourth Safety switch on Saddle → Settings, "Major WordPress releases", with the line "Apps can update WordPress to a new major version." and a "?" that explains it. Admin bundle rebuilt.

Testing

• 1512 tests, 1 skip that was already there (PHP 8.2, SQLite); phpcs 0 errors (6 warnings, none new); JS 342/342, lint:js clean
• The owner's POST /preferences turns it on and off; an editor gets 403 and nothing changes
• New: a major is refused by default even with WordPress's switch on; allowed with the Saddle setting even with WordPress's switch off (preview lists untested plugins); the runner hands an allowed major to core; the runner skips a major turned off after the confirm without calling the upgrader; the field is agent: read, default false, protected; update-module-settings refuses it
• Real install (Playground, the built 1.5.2 zip, WordPress 7.0.7 offered 7.1.3 by WordPress.org): refused by default, with WordPress's own switch off and again with it on; update-module-settings refused with the owner's link; update-option refused; the owner turned it on through /preferences; the preview showed a major with its three risks; the confirmed run updated the site 7.0.7 → 7.1.3 in 79 s and the site stayed up. On a second install the Safety switch showed, saved on a click, and get-module-settings read it as on.
• A pin test keeps WordPress's 5.6 default (auto_update_core_major = enabled), the reason for this change

🤖 Generated with Claude Code