WordPress: protect report retrieval and record trusted request closure #24

The CompleteTech integration audit found that terminal execution timestamps were being used as request closure, and reviewed findings were sent directly by ordinary email. The maintained WordPress integration needs the same reviewed lifecycle behavior as the site source candidate.

Acceptance:

• Bind strict acceptance to canonical client/signer identity and the exact Target Summary.
• Notify the confirmed recipient with a generic protected single-use report link; GET previews reveal no findings and change no state; POST redemption rechecks current authorization and atomically records the retrieval event.
• Require an explicit trusted administrator close or report-retrieval event for new-version closure; preserve legacy evidence retention and reject invalid/backwards dates.
• Keep findings for 366 days after trusted retrieval or an explicit no-report final close, and fail closed for missing or malformed event evidence.
• Serialize optional site manual closure and enqueue with the same queue lock and fresh database marker reads.
• Preserve no-scan defaults, existing target authorization/egress limits, and meaningful local/isolated database regression coverage.

Tracks maintained-source work required by CompleteTech-LLC/complete.tech#17. This issue does not authorize any customer target scan or activation. Repository source work and synthetic fixtures are the scope; production, customer consent, and legal sufficiency are separate prerequisites.