Defer user creation until email verification

[RabbiIslamRony]

PR Type

What kind of change does this PR introduce?

• Bugfix
• Security fix
• Improvement
• New Feature
• Refactoring (no functional changes, no api changes)
• Build related changes
• Text changes
• Other... Please describe:

Description

How to reproduce the issue or how to test the changes

1. Enable user registration and email verification, then submit the frontend registration form with a supplied password. Confirm that no WordPress user exists before the verification link is opened and that one pending record contains only a WordPress password hash, sanitized profile JSON, token HMAC, and salted IP hash.
2. Open the emailed verification link. Confirm that exactly one subscriber is created, the submitted password works, the existing registration hooks and notifications run, and the token cannot be reused.
3. Hide the password field and register again. Confirm that verification redirects to the one-time set-password form and that no generated plaintext password is stored.
4. Test 4, 60, and 61-character usernames in both frontend registration paths. Confirm that 4 and 60 are accepted and 61 is rejected.
5. Test expired and invalid tokens, duplicate username and email reservations, concurrent verification requests, resend cooldown and hourly limits, mail failure, daily cleanup, legacy verification links, and registration with verification disabled.
6. Run PHP syntax checks for all changed PHP files, Composer PHPCS for those files, and git diff --check.

The pending-registration table is installed idempotently with its own schema version. Pending links expire after 24 hours, tokens are stored only as HMACs, request limits are privacy-safe, and token claiming is transactional to prevent duplicate account creation.

Any linked issues

Fixes #1671

Checklist

• My code follows the WordPress coding standards

[RabbiIslamRony]

The PHPCS job stopped at the inherited actions/checkout@v3 step before repository checkout or PHP analysis. The current base workflow uses pull_request_target for fork code, and checkout now refuses that privileged operation. PR #2945 updates the shared workflow to a read-only pull_request job; once that workflow lands, this branch can be rerun normally. Locally, all seven changed PHP files pass PHP 8.2 syntax checks and the repository PHPCS rules with zero errors, and the new pending-registration class also has zero warnings.