C2PA Monitor: Preserve C2PA manifests through WordPress GD/Imagick subsize pipeline

[lnispel]

Context

Follow-up to #459 (C2PA Monitor experiment).

WordPress generates intermediate image sizes (thumbnails, medium, large) via its GD and Imagick pipelines. Both pipelines strip all APP markers (including APP11/JUMBF) when re-encoding JPEGs, and strip auxiliary chunks from PNG and WebP, leaving generated subsizes with no C2PA manifest.

What is needed

Investigate and implement a mechanism to re-embed the original C2PA manifest into generated subsizes so that downstream consumers (crop tools, CDNs, social embeds) can verify credentials regardless of which image size they access.

Possible approaches:

1. Post-process each generated subsize by copying the raw JUMBF bytes from the sidecar back into the sub-image via a wp_generate_attachment_metadata hook.
2. Hook into the GD / Imagick image editor classes to suppress manifest stripping.
3. Rely on the sidecar as the canonical manifest source and document that subsizes intentionally lack embedded manifests.

The capture pipeline in the current experiment preserves the manifest from the original upload only. This issue tracks the follow-up work.

Targeting

Target release: 1.4.0 (please milestone @jeffpaul / @dkotter).

Originates from: #459 and its Deferred section.