Improve core library file detection

[superdav42]

Summary

• Refine library_core_files so filenames are only candidate signals, not automatic failures.
• Match full core-library basenames instead of substrings inside arbitrary filenames.
• Require additional content evidence before reporting: package/library names or key JS globals for scripts, and matching global or core-namespaced PHP class/function symbols for PHP libraries.
• Add regression coverage for custom files named clipboard.js, polyfill.js, and custom-namespaced PHPMailer.php so they are not flagged as bundled core libraries.

Fixes #988.

Testing

• composer lint
• composer phpstan
• npm run test-php -- --filter File_Type_Check_Tests
• npm run test-php

Full PHPUnit result: OK (477 tests, 1352 assertions).

---

aidevops.sh v3.20.61 plugin for OpenCode v1.17.6 with gpt-5.5

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: superdav42 <superdav42@git.wordpress.org>
Co-authored-by: kkmuffme <kkmuffme@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.