fix: never publish a missed schedule, refuse trashed posts, fail on meta read errors

- PostGuard::editable() refuses trashed entries unless the caller opts in
  (content-get, revisions-list, post-trash); publish/schedule/unpublish/update/
  restore/duplicate/replace now refuse them.
- PostGuard::statusStable(): content-update, revision-restore and
  replace-with-copy refuse a future post whose date has passed (any save would
  publish it); the content-update rollback and PostCloner row writes re-check.
- PostCloner::ownMeta() treats a failed SELECT as an error; replace() reads the
  copy before its first write.
- replace-with-copy needs create_posts (backup clone) and reports backup_id in
  write_failed/partial_write.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/WordPress/Content/ContentGetAbility.php

@@ -59,14 +59,14 @@ final class ContentGetAbility implements Ability
 
     public function permission(array $input): bool|WP_Error
     {
-        $post = PostGuard::editable($input['post_id'] ?? null, $this->schema);
+        $post = PostGuard::editable($input['post_id'] ?? null, $this->schema, 'post_id', true);
 
         return $post instanceof WP_Error ? $post : true;
     }
 
     public function execute(array $input): mixed
     {
-        $post = PostGuard::editable($input['post_id'] ?? null, $this->schema);
+        $post = PostGuard::editable($input['post_id'] ?? null, $this->schema, 'post_id', true);
         if ($post instanceof WP_Error) {
             return $post;
         }

src/Integrations/WordPress/Content/ContentUpdateAbility.php

@@ -113,6 +113,11 @@ final class ContentUpdateAbility implements Ability
             return Errors::revMismatch();
         }
 
+        $unstable = PostGuard::statusStable($post);
+        if ($unstable !== null) {
+            return $unstable;
+        }
+
         if (array_key_exists('content', $input) && PostPresenter::usesDivi($post)) {
             return Errors::unsupported(
                 'Divi-Inhalte können nicht als Rohtext überschrieben werden; nichts wurde gespeichert.',
@@ -279,6 +284,12 @@ final class ContentUpdateAbility implements Ability
             return;
         }
 
+        // Both restore paths save through wp_update_post(), which would publish a missed schedule.
+        $current = get_post((int) $post->ID);
+        if ($current instanceof WP_Post && PostGuard::missedSchedule($current)) {
+            throw new RuntimeException('Post row not restored: saving it now would publish a missed schedule.');
+        }
+
         $fromRevision = array_values(array_intersect(array_keys($before), self::REVISIONED));
         if ($revisionId !== null && $fromRevision !== [] && wp_revisions_enabled($post)) {
             $restored = wp_restore_post_revision($revisionId, $fromRevision);