sirius-press: ship wp-cli in the image

The publishing docs tell operators to run `wp sirius export` and
`wp sirius status`, and the export plugin registers both — but a stack
built from docker/ had no wp-cli at all, so those pages described a tool
nobody running the bundled image actually had.

Pinned to a version and checked against its SHA-256 rather than piped
from a URL. It is the only thing the build downloads, which is exactly
why it is the only thing that has to prove what it is.

CHANGELOG.md

@@ -114,6 +114,15 @@ merge now runs in a scratch worktree and a failed run can be retried.
   the site's real `Host` header so the rendered page is unchanged and the
   internal address never reaches the output. The stack sets it by default.
 
+### Fixed while building a real site on it
+
+- **The image had no wp-cli.** `docs/publishing.md` documents
+  `wp sirius export` and `wp sirius status`, and the export plugin registers
+  both — on a stack built from `docker/`, neither existed. wp-cli is now in
+  the image, pinned to a version and checked against its SHA-256; it is the
+  only thing the build fetches, which is why it is the only thing that has to
+  prove what it is.
+
 ### Known gaps
 
 - No byte has yet been written to the real gateway under a registered name.

docker/Dockerfile

@@ -45,6 +45,24 @@ RUN { \
 		echo 'expose_php = Off'; \
 	} > /usr/local/etc/php/conf.d/sirius-press.ini
 
+# --- wp-cli ------------------------------------------------------------------
+#
+# docs/publishing.md documents `wp sirius export`, and the export plugin ships
+# a WP-CLI command, so an image without wp-cli makes those pages describe a
+# tool the operator does not have. Pinned and checksummed rather than piped
+# from a URL: this is the one thing in the image that is fetched at build
+# time, so it is the one thing that has to prove what it is.
+
+ENV WP_CLI_VERSION=2.12.0
+ENV WP_CLI_SHA256=ce34ddd838f7351d6759068d09793f26755463b4a4610a5a5c0a97b68220d85c
+
+RUN set -eux; \
+	curl -fsSL -o /usr/local/bin/wp \
+		"https://github.com/wp-cli/wp-cli/releases/download/v${WP_CLI_VERSION}/wp-cli-${WP_CLI_VERSION}.phar"; \
+	echo "${WP_CLI_SHA256}  /usr/local/bin/wp" | sha256sum -c -; \
+	chmod 755 /usr/local/bin/wp; \
+	wp --allow-root --version
+
 # --- core, from the subtree --------------------------------------------------
 
 COPY wordpress/ /opt/sirius-press/core/