Harden Starter Sites cache against orphaned/stale tiob_sites transients

[Copilot]

The Starter Sites library caches the demosites API response in the tiob_sites transient with only WordPress's timeout-row semantics for freshness. When a DB/transient-cleanup tool (WP Rocket, WP-Optimize, etc.) strips _transient_timeout_tiob_sites but leaves _transient_tiob_sites, get_transient() treats the value as non-expiring and serves a stale, partial library indefinitely — unrecoverable by update, reinstall, or cache clears.

Implements the two low-risk defenses from the issue (items 1 & 2) in includes/Sites_Listing.php:

• Self-validating freshness — wrap the cached payload with our own fetched_at stamp and validate it on read via a new get_cached_sites() helper, rather than trusting the transient timeout row. Any missing/malformed wrapper (including legacy raw payloads) or an age >= 12h forces a re-fetch.
• Version-stamped key — tiob_sites → tiob_sites_<TIOB_VERSION>, so every plugin update reads from a fresh key and self-heals a stuck cache.

// write
set_transient( $this->transient_key, array(
    'fetched_at' => time(),
    'data'       => $response,
), $this->cache_ttl );

// read (get_cached_sites)
$cache = get_transient( $this->transient_key );
if ( ! is_array( $cache ) || ! isset( $cache['fetched_at'], $cache['data'] ) ) {
    return false; // no wrapper (or legacy payload) → re-fetch
}
if ( ( time() - (int) $cache['fetched_at'] ) >= $this->cache_ttl ) {
    return false; // orphaned-timeout / expired → re-fetch
}
return $cache['data'];

Adds tests/sites-listing-test.php covering: version-stamped key, fresh fetch stores the wrapped payload, fresh cache served without a remote call, stale fetched_at re-fetches (the orphaned-timeout case), and legacy raw payload re-fetches.

Items 3 (a UI "Refresh templates" button) and 4 (surfacing fetch failures via Logger/notice) are intentionally out of scope here as larger cross-boundary changes.

[pirate-bot]

Plugin build for 4021d3b is ready 🛎️!

• Download build

[pirate-bot]

🎉 This PR is included in version 1.4.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀