[bordoni]

When a profile push to WorkOS failed, nobody found out. push_profile_to_workos() ignored the update_user() result and stamped _workos_last_synced_at either way. The common case is an email change to an address another WorkOS user already holds: WorkOS answers email_not_available, WordPress keeps the new email and WorkOS keeps the old one.

Stacked on #75 (fix/profile-name-push).

Changes

• The push checks the update_user() result.
• On error it leaves _workos_last_synced_at alone and stores the error on the user in _workos_sync_error (UserSync::META_SYNC_ERROR): the WorkOS code (or the WP_Error code for transport errors), message, fields and time.
• It writes a debug log line and a profile_push_failed Activity Log entry, and fires workos_profile_push_failed( $user_id, $workos_id, $update, WP_Error $error ).
• The next successful push clears the stored error. Unlinking the user clears it too.
• The WorkOS panel on the user-edit screen shows the stored error. profile_push_failed is in the Activity Log type filter.
• uninstall.php removes the new meta key. docs/profile-sync.md and AGENTS.md describe the hook and the meta.

Verified

• UserSyncProfilePushTest gains 7 tests: success stamps the sync time, email_not_available (meta, action arguments, Activity Log entry, sync time unchanged), a transport error, clearing on the next success, clearing on unlink, and the profile notice with and without an error. Six of them fail on the base branch.
• Full WPUnit suite passes: 778 tests, up from 761 on main, plus the 15 constants tests.
• phpcs and phpstan pass.

Closes #57