Native PHP: More lenient disable_functions

[fredrikekelund]

Related issues

• Fixes #

How AI was used in this PR

Claude was used to make the change, given precise instructions.

Proposed Changes

We're about to ship the native PHP runtime as a beta feature. It used to be that we altogether disallowed spawning child processes from PHP with the disable_functions directive. The intention was to make the defaults more secure. After discussing this more, we believe it would break several legitimate use cases. This PR follows up on our previous decisions by making disable_functions more lenient and by clarifying the limited security benefits our default protections yield.

Testing Instructions

CI should pass

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[wpmobilebot]

📊 Performance Test Results

Comparing dd9625f vs trunk

app-size

Metric	trunk	dd9625f	Diff	Change
App Size (Mac)	1329.73 MB	1329.73 MB	0.00 MB	⚪ 0.0%

site-editor

Metric	trunk	dd9625f	Diff	Change
load	1659 ms	1651 ms	8 ms	⚪ 0.0%

site-startup

Metric	trunk	dd9625f	Diff	Change
siteCreation	9029 ms	9004 ms	25 ms	⚪ 0.0%
siteStartup	4424 ms	4422 ms	2 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)