Add automatic cleanup of old core files using WordPress $_old_files list

[Copilot]

When checksums are unavailable for a WordPress version/locale combination, wp core update warns users to manually cleanup old files. This PR uses WordPress core's $_old_files global array to automatically cleanup these files instead.

Changes

Modified cleanup_extra_files() to use fallback strategy:

• When checksums unavailable: use $_old_files for unconditional cleanup
• When checksums available: combine checksum-based verification with $_old_files for files not tracked in checksums

Added cleanup methods:

• cleanup_old_files() - deletes all files from $_old_files when checksums unavailable
• cleanup_old_files_not_in_checksums() - supplements checksum cleanup by removing $_old_files entries not in checksum arrays
• get_old_files_list() - centralizes access to wp-admin/includes/update-core.php and $_old_files array
• remove_old_files_from_list() - shared helper method that handles file/directory removal with path validation (eliminates code duplication)
• remove_directory() - recursive directory removal with path validation, symlink handling, and error handling

Security & Safety features:

• Path validation ensures operations stay within ABSPATH
• Handles symbolic links without following them (prevents potential security issues)
• Skips files when realpath() fails (prevents path traversal attacks)
• Caches ABSPATH realpath for performance optimization
• Skips wp-content directory (user data protection)
• Debug logging for all failures

Behavior changes:

• Nightly builds and old versions now cleanup automatically instead of warning
• Example: wp core update --version=3.1 --force now shows "Cleaning up files..." instead of "Warning: Checksums not available for WordPress 3.1/en_US. Please cleanup files manually."

All cleanup operations skip wp-content directory (user data) and log debug messages on failure.

• Fixes Way to delete old core files after core update #141

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Way to delete old core files after core update</issue_title>
<issue_description>## Feature Request

• Yes, I reviewed the contribution guidelines.

Describe your use case and the problem you are facing
Currently there is no way to delete old core files if during the update checksums for target WP version and locale aren't available.
Describe the solution you'd like
Command or a flag to delete old core files.
A clear and concise description of what you want to happen.
A way to delete old core files after core update exists.
</issue_description>

<agent_instructions>The list of old files in core can be retrieved by including wp-admin/includes /update-core.php and then accessing the global $_old_files variable</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@schlessera WP-CLI currently diffs the old checksums against the new checksums to decide what left-overs to purge in https://github.com/wp-cli/core-command/blob/1fa06e0cdb5d378585a69d01c94ad2d33278cf28/src/Core_Command.php#L1350-L1393

However, for combinations of locales & versions that we don't have checksums available, this just fails with a message that cleaning up by hand is required.

However, WordPress provides a list of files that are supposed to be deleted and deletes them by default on update: https://github.com/WordPress/wordpress-develop/blob/a216b6d83845dc4cdd01ff517cdf36b72043b6b3/src/wp-admin/includes/update-core.php#L20-L791

We should combine this data with the checksums, to use the checksums to only delete old files when they have not been modified, and to unconditionally delete old files when we don't have checksums to verify for modifications.</comment_new>
<comment_new>@schlessera
@Aaron-Ritter This is indeed still an issue. The latest update for this is that release 5.9 showed that the WordPress update process is broken as well and will be rethought for 6.0. Hopefully, that rethinking can also include WP-CLI-usable logic that just works.</comment_new>

• Fixes Way to delete old core files after core update #141

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[codecov]

Codecov Report

❌ Patch coverage is 68.68687% with 31 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/Core_Command.php	68.68%	31 Missing ⚠️

📢 Thoughts on this report? Let us know!

[wojsmol]

we also need to check that this will not cause a regression of #196