Resolve Plugin Check release proof findings

[mehul0810]

Summary

• replace direct runtime diagnostics is_writable() checks with wp_is_writable()
• sanitize the Assets Manager reset request URI before URL mutation
• include composer.json in packaged builds when vendor/ is present
• shorten the 1.7.0 upgrade notice to satisfy Plugin Check

Issue

Works toward #167.

Validation

• git diff --check
• php -l src/Admin/Settings/RuntimeDiagnostics.php
• php -l src/Modules/Assets/AssetsManager.php
• composer validate --no-check-publish
• composer lint
• composer phpstan
• composer test
• npm run plugin-zip
• packaged ZIP check: studio wp plugin check perform-rc-check --slug=perform --path /Users/mehulgohil/Studio/development --format=csv --fields=file,line,column,type,code,message --mode=update -> Success: Checks complete. No errors found.

Proof notes

• Plugin Check was run against the generated perform.zip by installing the package as a temporary inactive Studio plugin slug perform-rc-check; the temporary copy was removed after validation.
• No production/beta tag, release, WordPress.org publish, main merge, or human contributor PR/issue action was taken.

UI/browser proof

• Not applicable: this is release packaging/static-analysis cleanup with no intended UI change. Existing release-branch Playwright Smoke was green after Prepare 1.7.0 release metadata #166; CI will rerun for this PR where configured.

[github-actions]

Test on Playground
Test this pull request on the Playground