fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Integration/divi-convert-fixture.php

@@ -7,6 +7,8 @@
  * Paths are relative to the plugin's tests/Fixtures/divi directory.
  */
 
+defined('WP_CLI') && WP_CLI || exit;
+
 use ET\Builder\Packages\Conversion\Conversion;
 
 $args = $args ?? [];

tests/Unit/DirectAccessGuardTest.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit;
+
+use RecursiveDirectoryIterator;
+use RecursiveIteratorIterator;
+
+/**
+ * Security audit L2: every PHP file is only executable inside WordPress – a direct HTTP request
+ * to a file under src/ exits silently instead of printing a fatal error with the server path.
+ * The integration scripts under tests/Integration run only under WP-CLI.
+ */
+final class DirectAccessGuardTest extends TestCase
+{
+    public function testEverySourceFileExitsOutsideWordPress(): void
+    {
+        $root = dirname(__DIR__, 2);
+        $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($root . '/src'));
+        $checked = 0;
+        foreach ($files as $file) {
+            if (! str_ends_with((string) $file, '.php')) {
+                continue;
+            }
+
+            $checked++;
+            self::assertMatchesRegularExpression(
+                "/^defined\\('ABSPATH'\\) \\|\\| exit;$/m",
+                (string) file_get_contents((string) $file),
+                substr((string) $file, strlen($root) + 1)
+            );
+        }
+
+        self::assertGreaterThan(100, $checked);
+    }
+
+    public function testIntegrationScriptsRunOnlyUnderWpCli(): void
+    {
+        foreach (glob(dirname(__DIR__) . '/Integration/*.php') ?: [] as $file) {
+            self::assertStringContainsString(
+                "defined('WP_CLI') && WP_CLI || exit;",
+                (string) file_get_contents($file),
+                basename($file)
+            );
+        }
+    }
+}