fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/ChangeLog/ChangeLog.php

@@ -8,6 +8,8 @@ use LIT\MCP\Abilities\FollowUp;
 use LIT\MCP\Log;
 use LIT\MCP\Server\RequestContext;
 
+defined('ABSPATH') || exit;
+
 /**
  * Change log table {prefix}lit_mcp_log (spec §8.3). Stores references only,
  * never content. Deliberately not final so abilities can be unit-tested with a mock.

src/ChangeLog/ChangeLogCleanup.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\ChangeLog;
 
 use LIT\MCP\Limits;
 
+defined('ABSPATH') || exit;
+
 /**
  * Daily WP-Cron job that removes log rows older than the configured retention.
  */

src/ChangeLog/ChangeLogInstaller.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\ChangeLog;
 
+defined('ABSPATH') || exit;
+
 /**
  * Creates/updates the change log table via dbDelta. Runs on activation and –
  * because plugin updates never fire the activation hook – whenever the stored