✨ feat(bones): a plugin's own stubs/ comes first; stub:publish

[gfazioli]

Closes #133.

Every make:* command read its stub from vendor/wpbones/wpbones/src/Console/stubs and nowhere else, so a team could change what the generators write only by editing vendor/, which the next composer update put back.

What changes

• getStubContent() reads stubs/{name}.stub from the plugin root first, prints Using stubs/{name}.stub, and falls back to the framework's. Every make:* command and migrate:to-v2's config files go through it. A stub found nowhere now stops the command before anything is written (it used to go on).
• php bones stub:publish [<stub> ...] [--force] copies the framework's stubs into stubs/: all of them, or the ones named (controller and controller.stub alike). A stub already there is kept unless --force; an unknown name exits 1, lists the stubs there are, and writes nothing.
• deploy leaves the plugin's .stub files out. A stubs/ folder that holds nothing else goes whole; one that also ships other files keeps them, so a plugin with a runtime stubs/ folder is not broken by the upgrade.
• The help lists stub:publish under a new stub group.

Proof

• composer test: 360 tests, 993 assertions (350 / 897 on master). tests/Console/StubOverridesTest.php, 10 tests: 9 failed before the change (the fallback one passed, as it should).
• WPKirk-Developing, .claude/scripts/stubs-live-smoke.sh (new): 7 ✗ of 7 on v3.0.0, 7 ✓ of 7 on this branch, debug.log unchanged.
  • stub:publish controller copies the framework's stub byte for byte;
  • make:controller fills the edited copy, says so, and writes a file that parses;
  • a second publish keeps the edited stub, --force replaces it;
  • an unknown stub exits 1 and writes nothing;
  • deploy --no-build ships the plugin and leaves stubs/ out (on v3.0.0 a hand-written stub was shipped);
  • the help lists the command.
• Codex review (gpt-6-sol, high) against origin/master: no findings. Copilot's quota is exhausted.