[cport1]

Companion to WebDecoy/app#1736. Not released: no version bump, no release.sh, no R2 upload.

What changed

• What happened column on Detections (after Date): one plain sentence for each tripwire hit, the same words the WordPress digest email uses for the same hit. Rows that are not decoy hits (heuristic scoring, test triggers, the decoy-served follow-up row) show nothing new; the technical columns stay as they were.
• sdk/src/HitExplanation.php: PHP port of pkg/hitexplain.Explain. The sentences are not written here: sdk/src/registry/hit-explanations.generated.php and hit-explanation-vectors.generated.json are generated by go run ./cmd/export-hit-explanations -php|-golden in WebDecoy/app.
• Each tripwire hit records trap_kind: hidden_link (honeytoken), fake_plugin (absent-plugin prefixes, now their own rule), trap_path (xmlrpc.php, custom paths), probe_path (default scanner paths), author_lookup / user_list (enumeration traps). It goes into the local row and the reported violation, so the cloud digest picks the same sentence.
• Rows written before this have no kind and get an honest fallback: the hidden-link sentence for /__wd/ paths, otherwise "a path set up as a trap on your site".

Sentences say only what the hit records. They never claim how the visitor found the path or that anything was blocked. Query strings, fragments and control characters never reach a sentence, and the cell is esc_html'd. Copy is English only: the table is generated, so it is not in the .pot.

Tests (php tests/run.php, 210 passed)

• Every golden vector from Go reproduces kind and sentence exactly (seen failing on a one-character drift).
• Invalid UTF-8 path counts as not recorded.
• Local rows: tripwire rows explained from stored flags, legacy rows fall back, non-decoy rows get nothing.
• TripwireRule records the right kind per rule; an unknown kind cannot pick a sentence.
• Source scan: every trap kind the plugin records is one the shared table knows.

From WebDecoy/app, WEBDECOY_WORDPRESS_PLUGIN=<this checkout> go test ./cmd/export-hit-explanations/ proves these generated files match pkg/hitexplain byte for byte.

Part of WebDecoy/app#443.