PHPCS zero-violation cleanup + GA4 event alignment + server-side Woo funnel events

[Atroci]

Summary

This PR has two parts: a full PHPCS cleanup (787 violations → 0) and two gap-closure features identified by an architecture review (GA4 vocabulary alignment and server-side WooCommerce funnel events). No existing runtime behavior changes; all new behavior is additive or behind a default-off flag.

---

Part 1 — PHPCS: 787 → 0 violations

Against the project standard (phpcs.xml.dist — WordPress-Core/Extra/Docs + PSR formatting subset); vendor/bin/phpcs now exits 0 across all files.

• PHPCBF auto-fixes (649, 57 files): alignment, whitespace, array spacing, indentation, file newlines.
• Manual fixes (138, 35 files): accurate docblocks with real @param/@return descriptions, inline-comment punctuation, Yoda conditions.
• File renames: class-site-health.php → class-sitehealth.php, abstract-form-adapter.php → class-abstract-form-adapter.php (now also match the autoloader's class→file mapping); manual require references updated.
• Justified // phpcs:ignore annotations (no code change): base64 (AES-GCM ciphertext + Base64URL tokens, not obfuscation), @inet_pton (false returns checked), local file_get_contents, sub-15-min cron interval, reserved-keyword/hook-mandated params, Gravity Forms camelCase API properties.

Part 2 — GA4 event-name alignment (additive)

New CLICUTCL\Tracking\Event_Name_Map owns the internal→GA4 and internal→Meta vocabularies (lead→generate_lead, qualified_lead→qualify_lead, book_appointment→working_lead, order_refunded→refund, …).

• All 7 server-side adapters decorate the outbound body only with ga4_event_name (+ platform_event_name for Meta CAPI). event_name stays internal everywhere — stored data, dedup keys, queue rows, milestone markers untouched.
• order_paid deliberately unmapped to avoid double-counting GA4 purchase.
• Filters: clicutcl_event_name_map, clicutcl_meta_event_name_map, and opt-in clicutcl_ga4_rename_outbound (default off) which renames outright for sGTM/generic destinations while preserving source_event_name.
• Browser layer mirrors the map: dataLayer pushes carry top-level ga4_event_name; canonical v2 events carry it in meta. Existing GTM triggers keep firing.
• v1→v2 translator classifies inbound GA4 vocabulary like its internal counterparts.

Part 3 — Server-side WooCommerce funnel events (opt-in, default off)

view_item, add_to_cart, begin_checkout emitted from PHP through the same Dispatcher path as purchase (consent gate, dedup, queue/retry, logging), behind a new woocommerce_funnel_server_events feature flag with an admin toggle.

• Deterministic event IDs: view_item_{product}_{session}, add_to_cart_{cart_item_key}_{session}_{minute_bucket}, begin_checkout_{session}_{cart_hash[0:8]}.
• Payloads mirror the purchase shape; no identity block pre-purchase (no added PII/consent surface). New clicutcl_woocommerce_storefront_event_payload filter.
• Anti-double-count: when the flag is on, the browser layer keeps its dataLayer push but suppresses the REST transport for these three events; view_item/begin_checkout reuse the PHP-computed event_id for GTM-side dedup.
• Feature registry + test matrix entries included.

Verification

• vendor/bin/phpcs --standard=phpcs.xml.dist → exit 0, zero violations
• vendor/bin/phpunit → 30 tests, 40 assertions, all green (13 new for Event_Name_Map, 7 new for the funnel event-id builder)
• node --check clean on both touched JS files
• npm run smoke → 40 registry-backed smoke IDs pass
• php -l clean on every changed file

Note for reviewers

The PHPCS CI job (.github/workflows/php-lint.yml) may currently fail with "Referenced sniff WordPress-Core does not exist" when Composer runs as root, because the dealerdirect/phpcodesniffer-composer-installer plugin gets disabled and WPCS paths are never registered. Worth hardening in a follow-up (e.g. explicitly set installed_paths or allow the plugin in CI).

https://claude.ai/code/session_0185zSs2xHGNh34UnBT5rXnF