Bound sitemap preload traversal

[mehul0810]

Summary

Closes #104.

Bound page-cache sitemap preload traversal so one seed run stops after a limited number of child sitemap fetches and after the existing URL cap is filled, instead of fetching every child sitemap first and trimming later.

Base Branch Evidence

• Issue Bound Page Cache sitemap preload work on large sites #104 is assigned to milestone 1.7.0.
• The matching release branch release/1.7.0 exists on origin.
• origin/release/1.7.0 is the active release line for this milestone and is already ahead of develop with release-scoped cache work merged in PR Harden CDN rewrite load gating #129, so this fix branches from and targets release/1.7.0.

Scope

• Add bounded child-sitemap traversal to PageCache::fetch_urls_from_sitemap().
• Stop fetching child sitemaps once the per-run URL cap is satisfied.
• Deduplicate sitemap URLs during collection instead of only after all child fetches complete.
• Add unit-test bootstrap HTTP helpers plus regression coverage for traversal limits, early URL-cap exits, and fetch-failure queue preservation.

Intentionally Excluded

• No cursor/checkpoint persistence across multiple sitemap seed runs.
• No settings or UI changes for preload tuning.
• No queue option schema changes or migration work.

Validation

• php -l src/Modules/Cache/PageCache.php
• php -l tests/bootstrap.php
• php -l tests/unit-tests/tests-page-cache.php
• ./vendor/bin/phpunit --filter Tests_Page_Cache
• composer test
• composer lint
• ./vendor/bin/phpstan analyse --memory-limit=2048M --debug

Compatibility, Security, Privacy

• Keeps the existing preload queue option contract intact.
• Continues to accept only same-site HTTP(S) sitemap URLs.
• Network failures still short-circuit safely without clearing the existing preload queue.
• No new user data, secrets, telemetry, or public API surface introduced.

Rollback and Release Notes

• Rollback is a straight revert of this PR's commit.
• No version bump, migration, or release artifact change is required.
• Release impact is limited to safer preload seeding behavior on larger sites.

Docs Status

• No AGENTS.md update needed for this code-only runtime fix.
• No in-repo docs or performwp.com docs change is required because this does not add a new setting, hook, or user-facing workflow.

Remaining Risk

• I did not run a live cron/preload smoke test against a WordPress site from this worktree, so runtime proof is limited to unit/static validation.

@mehul0810 for release-line visibility.

[github-actions]

Test on Playground
Test this pull request on the Playground