* feat: add authenticated download URLs for headless frontends
- Add downloadNonce and downloadUrl fields to DownloadableItem type
using the existing Protected Router session transfer pattern
- Add preAuthDownloadUrl field (toggleable via settings) that generates
tokenized download URLs for direct file access without cookie auth
- Add download_url nonce handling to Protected_Router
- Add enable_pre_auth_download_urls and download_url_nonce_param settings
- Add GraphQLE2E helpers for checkout and account shortcode pages
- Rewrite ProtectedRouterCest to test redirect flow without JS-dependent
page content assertions, add account and payment method URL tests
- Add DownloadableItemAuthCest with 5 e2e tests covering both options
* fix: test suite stability and code coverage collection
- Add WC_Unit_Tests_Bootstrap stub to wpunit bootstrap to bypass
wc_get_product_visibility_term_ids static cache between suites
- Add setWooGraphQLSetting helper to GraphQLE2E for safe individual
field updates to woographql_settings option with proper defaults
- Update all functional tests to use setWooGraphQLSetting instead of
replacing the entire woographql_settings option
- Fix createRelated factory to use explicit shared category instead
of relying on default Uncategorized category
- Add download_url to ProtectedRouterTest nonce names assertion
- Remove debug logs from ProductQueriesTest and ProductsQueriesTest
- Fix CI workflow to run suites separately and aggregate coverage
via phpcov merge
- Wire c3.php into WordPress index.php for remote coverage collection
- Update .coveralls.yml service_name to github-actions
- Clean up Xdebug 2 settings in Dockerfile
* chore: Linter compliances met
* fix: ensure tests/_output is writable for c3.php coverage collection
* devops: .env.docker removed from setup
* devops: split CI into separate jobs per suite with retry and coverage aggregation
* devops: add +Coverage indicator to CI job names
* devops: add --fail-fast to first run, fix retry to mark job as passing on retry success
