feat(cache): Verhaltensprobe und Smoke für WP Super Cache

SuperCacheProbe prüft beim Prüfen, ob wp_cache_post_edit die Cache-Datei einer Testseite entfernt; während der Probe ist nur der Einzelseiten-Purge erlaubt, der Pfad kommt aus home und es werden nur feste Dateinamen gelöscht. ProbeStep bündelt die Schrittlogik von Pods und WP Super Cache; ThrowawayPost hält Marker und Titel zentral und räumt auch private Probe-Seiten auf (WP Super Cache wie Pods beim Laden des Reiters). super-cache-smoke.sh prüft gegen das echte Plugin; lib.sh sperrt parallele Smoke-Läufe per flock, wp-config.php wird atomar wiederhergestellt. Doku: Host-Abhängigkeit des Einzel-Purges, WP-Cron für den Nachlauf, Komplett-Purge durch Divi beim Prüfen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Integration/lib.sh

@@ -5,6 +5,13 @@
 # sourcing – HOST below shells out to `wp` immediately).
 # Requires jq and curl (both present in the DDEV web image).
 
+# Mutual exclusion of ALL smokes (every one sources this file inside the same web container): two at once would
+# share one site state – WP Super Cache edits wp-config.php, every smoke empties the test application passwords of the
+# admin (cleanup_app_passwords_for, harmless only because of this lock), Pods/Divi release options. The lock lives as
+# long as the script (fd 9 closes with it); a smoke that runs a second one itself must not source this file twice.
+exec 9>/tmp/lit-mcp-smoke.lock
+flock -n 9 || { echo "FAIL: another smoke is running (lock /tmp/lit-mcp-smoke.lock)"; exit 1; }
+
 PLUGIN=wp-content/plugins/WP-LIT-MCP
 ENDPOINT=http://localhost/wp-json/mcp/mcp-oauth-server
 
@@ -14,6 +21,10 @@ ENDPOINT=http://localhost/wp-json/mcp/mcp-oauth-server
 # the code under test.
 HOST=$(wp option get home | sed -E 's#^[a-zA-Z]+://##')
 
+# Optional: the Host header MCP requests carry (default: curl's own, "localhost"). A cache plugin that keys its files
+# by the request's host (WP Super Cache) needs the site's real host here (super-cache-smoke.sh sets it).
+MCP_HOST=${MCP_HOST:-}
+
 TOKEN=""
 SESSION=""
 INIT_RESPONSE=""
@@ -36,7 +47,8 @@ guard_exit() {
 }
 pass() { echo "ok   - $*"; }
 
-# Removes every "lit-mcp-integration-test" application password of a user.
+# Removes every "lit-mcp-integration-test" application password of a user (of ANY run – safe only under the smoke
+# lock above: no other smoke can be using one).
 cleanup_app_passwords_for() { # $1 = user_login
   local login="$1"
   [ -n "$login" ] || return 0
@@ -68,7 +80,10 @@ mint_token() { # $1 = user_login -> prints the token
 mcp() { # $1 = token, $2 = json body, $3 = session id (optional)
   local session_header=()
   [ -n "${3:-}" ] && session_header=(-H "Mcp-Session-Id: $3")
+  local host_header=()
+  [ -n "$MCP_HOST" ] && host_header=(-H "Host: $MCP_HOST")
   curl -s --max-time 20 -i -X POST "$ENDPOINT" \
+    "${host_header[@]}" \
     -H "Authorization: Bearer $1" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
@@ -93,7 +108,10 @@ rpc() { # $1 = method, $2 = params JSON
   body=$(jq -cn --arg m "$1" --argjson p "$2" --argjson id "$REQUEST_ID" '{jsonrpc: "2.0", id: $id, method: $m, params: $p}')
   local session_header=()
   [ -n "$SESSION" ] && session_header=(-H "Mcp-Session-Id: $SESSION")
+  local host_header=()
+  [ -n "$MCP_HOST" ] && host_header=(-H "Host: $MCP_HOST")
   curl -s --max-time 60 -X POST "$ENDPOINT" \
+    "${host_header[@]}" \
     -H "Authorization: Bearer $TOKEN" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \