refactor: PostRow::update and PostGuard::assertNoMissedSchedule (M5)

- PostRow::update(id, columns, failure) / ::save(): the slashed wp_update_post of
  internal row writes, refusals as RuntimeException '<failure>: <why>'. Used by
  ContentUpdate::restoreRow, PostCloner::updateRow, MediaMetaWriter apply/restore.
- PostGuard::assertNoMissedSchedule(postId, message) replaces the re-read + check in
  ContentUpdate::restoreRow, PostCloner and DiviSaver::restore (DiviSaver keeps its
  own kses window; M4).
- PostCloner::restore uses Rollback::attempt.
Log messages unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/Integrations/WordPress/PostGuard.php

@@ -6,6 +6,7 @@ namespace LIT\MCP\Integrations\WordPress;
 
 use LIT\MCP\Abilities\Errors;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
+use RuntimeException;
 use WP_Error;
 use WP_Post;
 
@@ -83,6 +84,21 @@ final class PostGuard
         return $time !== false && $time <= time() + self::PUBLISH_WINDOW;
     }
 
+    /**
+     * For internal writes (rollbacks, clone rows): wp_update_post() would publish a missed
+     * schedule (see missedSchedule()), so the entry is re-read and such a save is refused.
+     * $message is the internal log text of the RuntimeException.
+     *
+     * @throws RuntimeException
+     */
+    public static function assertNoMissedSchedule(int $postId, string $message): void
+    {
+        $post = get_post($postId);
+        if ($post instanceof WP_Post && self::missedSchedule($post)) {
+            throw new RuntimeException($message);
+        }
+    }
+
     /**
      * Refuses a write that would change the status as a side effect (spec §2: status is only
      * changed on explicit request) – currently a missed schedule, which any save would publish.