Sync with upstream Bedrock

[retlehs]

This PR syncs upstream Bedrock changes into the Pantheon fork

• WPackagist → WP Packages
• Removed roots/wp-password-bcrypt (WordPress 6.8 ships native bcrypt password hashing)
• config/application.php changes:
  • Env\Env::$options as named constants — replaces the magic value 31 with explicit flags (Bedrock reference). Pantheon's flag set is preserved exactly: USE_ENV_ARRAY is kept (needed for the $_ENV[...] syntax in .env.example), and LOCAL_FIRST is intentionally not added (Pantheon's Lando-aware loading handles env precedence differently).
  • WP_ENVIRONMENT_TYPE — derives from env or falls back to WP_ENV if it matches a recognized value.
  • WP_DEVELOPMENT_MODE — supports the WP 6.3+ development-mode flag via env.
  • DB_SSL — opt-in MySQL SSL (MYSQLI_CLIENT_SSL), no-op unless the env var is set.
  • DISABLE_WP_CRON — env-configurable for sites running cron externally.
  • CONCATENATE_SCRIPTS = false — Bedrock convention to disable WP's built-in script concatenation.
• composer.json housekeeping
  • Default theme: wpackagist-theme/twentytwentytwo:^1.2 → wp-theme/twentytwentyfive:^1.0. The previous theme is from WP 5.9 (Jan 2022); twentytwentyfive is the current default in WP 6.7+.
  • "sort-packages": true added under config: — keeps composer.lock diffs deterministic.
  • Both require and require-dev alphabetized so sort-packages is meaningful immediately, not just for future additions.

Happy to adjust anything.

Disclosure: I'm one of the Bedrock maintainers.