ci: install subversion in publish-svn workflows

[sherwinski]

One Line Summary

Installs subversion on the runner before the SVN deploy step, since ubuntu-latest no longer ships with svn preinstalled.

Motivation

Follow-up to #424. When re-tagging v3.9.0 to trigger the now-permission-fixed publish-svn.yml, the run got past the reusable-workflow startup check but failed in the Deploy to SVN trunk step:

```
/home/runner/work/_temp/.../svn: command not found
##[error]Process completed with exit code 127.
```

See run: https://github.com/OneSignal/OneSignal-WordPress-Plugin/actions/runs/26300779118

svn is no longer a default-installed binary on ubuntu-latest; it must be installed explicitly with apt-get install -y subversion.

Scope

• Affected: .github/workflows/publish-svn.yml and .github/workflows/publish-svn-v2.yml — adds an Install subversion step right after checkout in both publish jobs.
• Not affected: plugin source, release workflows, tag-on-merge workflow.

Testing

Manual

Validation after merge: re-tag v3.9.0 at the new fix commit so publish-svn.yml runs end-to-end and 3.9.0 lands on WordPress.org trunk + tags.

Unit / Integration

• N/A — CI workflow change only.

Affected code checklist

• PHP plugin code (v3/)
• v2/ legacy code
• JS / CSS assets
• Build / CI
• Tests
• Documentation

Checklist

• Code follows existing style in the touched files
• No new lint or test errors introduced

[claude]

LGTM — straightforward CI fix to install subversion since it's no longer preinstalled on ubuntu-latest.

Extended reasoning...

Overview

This PR adds an Install subversion step (sudo apt-get update && sudo apt-get install -y subversion) immediately after the checkout step in both .github/workflows/publish-svn.yml and .github/workflows/publish-svn-v2.yml. The change is a direct, mechanical fix for the svn: command not found failure that occurred when publish-svn.yml finally ran end-to-end after the permissions fix in #424.

Security risks

None of note. The added step runs apt-get install for the subversion package from the runner's default apt sources, which is standard practice on GitHub-hosted runners. No secrets handling, no shell injection surface, and no change to authentication or release content.

Level of scrutiny

Low — this is a CI-only workflow change with an obvious motivation (the runner image no longer ships svn), an obvious fix (install it), and minimal blast radius. The PHP plugin code, JS/CSS assets, and release workflows themselves are untouched. The change is symmetric across the v2 and v3 workflows, which is the correct shape.

Other factors

No bugs were found by the bug hunting system. The diff is six lines, identical pattern in both files, and the placement (immediately after checkout, before any svn invocation) is correct. There are no outstanding reviewer comments.