fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

phpcs.xml.dist

@@ -7,7 +7,10 @@
     <arg value="sp"/>
     <arg name="extensions" value="php"/>
     <arg name="basepath" value="."/>
-    <rule ref="PSR12"/>
+    <rule ref="PSR12">
+        <!-- Every file starts with defined('ABSPATH') || exit; (no direct HTTP access, security audit L2). -->
+        <exclude name="PSR1.Files.SideEffects.FoundWithSymbols"/>
+    </rule>
     <rule ref="WordPress.Security">
         <exclude name="WordPress.Security.EscapeOutput.ExceptionNotEscaped"/>
     </rule>