fix: never publish a missed schedule, refuse trashed posts, fail on meta read errors

- PostGuard::editable() refuses trashed entries unless the caller opts in
  (content-get, revisions-list, post-trash); publish/schedule/unpublish/update/
  restore/duplicate/replace now refuse them.
- PostGuard::statusStable(): content-update, revision-restore and
  replace-with-copy refuse a future post whose date has passed (any save would
  publish it); the content-update rollback and PostCloner row writes re-check.
- PostCloner::ownMeta() treats a failed SELECT as an error; replace() reads the
  copy before its first write.
- replace-with-copy needs create_posts (backup clone) and reports backup_id in
  write_failed/partial_write.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/WordPress/Status/PostReplaceWithCopyAbilityTest.php

@@ -31,6 +31,7 @@ final class PostReplaceWithCopyAbilityTest extends TestCase
         $this->copy = new WP_Post(['ID' => 77, 'post_type' => 'page', 'post_title' => 'Team (Kopie)', 'post_status' => 'draft']);
         Functions\when('get_post')->alias(fn (int $id) => $id === 5 ? $this->original : $this->copy);
         Functions\when('current_user_can')->justReturn(true);
+        Functions\when('get_post_type_object')->justReturn((object) ['cap' => (object) ['create_posts' => 'edit_pages']]);
         Functions\when('get_post_meta')->justReturn('5');
         Functions\when('get_permalink')->justReturn('https://kunde.de/team/');
         Functions\when('get_edit_post_link')->justReturn('https://kunde.de/wp-admin/post.php?post=5&action=edit');
@@ -105,6 +106,20 @@ final class PostReplaceWithCopyAbilityTest extends TestCase
         self::assertSame('lit_validation_failed', $result->get_error_code());
     }
 
+    public function testAMissedScheduleOfTheOriginalIsRefused(): void
+    {
+        $this->original->post_status = 'future';
+        $this->original->post_date_gmt = gmdate('Y-m-d H:i:s', time() - 600);
+        $cloner = Mockery::mock(PostCloner::class);
+        $cloner->expects('backup')->never();
+        $cloner->expects('replace')->never();
+
+        $result = $this->ability($cloner, Mockery::mock(ChangeLog::class))->execute($this->input());
+
+        self::assertSame('lit_validation_failed', $result->get_error_code());
+        self::assertArrayHasKey('original_id', $result->get_error_data()['fields']);
+    }
+
     public function testAPendingCopyIsAccepted(): void
     {
         $this->copy->post_status = 'pending';
@@ -215,6 +230,7 @@ final class PostReplaceWithCopyAbilityTest extends TestCase
         } catch (WriteFailed $e) {
             self::assertTrue($e->rolledBack);
             self::assertSame('lit_write_failed', $e->toError()->get_error_code());
+            self::assertSame(88, $e->toError()->get_error_data()['backup_id']);
         }
     }
 
@@ -239,10 +255,26 @@ final class PostReplaceWithCopyAbilityTest extends TestCase
             self::assertFalse($e->rolledBack);
             self::assertSame(5, $e->postId);
             self::assertSame(900, $e->revisionId);
-            self::assertSame('lit_partial_write', $e->toError()->get_error_code());
+            $error = $e->toError();
+            self::assertSame('lit_partial_write', $error->get_error_code());
+            self::assertSame(88, $error->get_error_data()['backup_id']);
+            self::assertStringContainsString('Sicherung', $error->get_error_message());
+            self::assertStringContainsString('88', $error->get_error_message());
         }
     }
 
+    public function testNeedsTheRightToCreateEntriesForTheBackup(): void
+    {
+        Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap !== 'edit_pages');
+        $cloner = Mockery::mock(PostCloner::class);
+        $cloner->expects('backup')->never();
+        $cloner->expects('replace')->never();
+        $ability = $this->ability($cloner, Mockery::mock(ChangeLog::class));
+
+        self::assertSame('lit_forbidden', $ability->permission($this->input())->get_error_code());
+        self::assertSame('lit_forbidden', $ability->execute($this->input())->get_error_code());
+    }
+
     public function testAFailedBackupAbortsBeforeTheOriginalIsTouched(): void
     {
         $cloner = Mockery::mock(PostCloner::class);