All Submissions:

• Have you followed the Newspack Contributing guidelines?
• Does your code follow the WordPress coding standards and VIP Go coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

Fixes NPPD-1670. Content gates with taxonomy-term content rules now cascade to a targeted term's child terms for hierarchical taxonomies (categories), matching WooCommerce Memberships.

Previously Content_Restriction_Control::get_post_gates() matched a post's term IDs against a rule's term IDs with a flat array_intersect, so a rule targeting a parent category did not gate posts assigned only to a child category. Restricted content leaked: a publisher reported no paywall appearing on child-category posts.

The fix adds a private expand_hierarchical_terms() helper that expands a hierarchical-taxonomy rule's target terms to include all descendants (via get_term_children()) before the intersect. Key properties:

• Evaluation-time expansion, so child terms added after a rule is saved are covered automatically (matches Woo's dynamic behavior).
• Symmetric for inclusion and exclusion rules.
• No-op for non-hierarchical taxonomies (tags), and no public-contract change (private method only) — the cross-repo newspack-manager consumer is unaffected.

How to test the changes in this Pull Request:

1. Create a category tree (parent → child → grandchild) and a post assigned only to the child or grandchild category (not the parent).
2. Create a content gate with a content rule targeting the parent category, with registration or custom access active.
3. Visit the child/grandchild post as a logged-out reader → the gate (paywall/regwall) now appears. Before this change it did not.
4. Flip the rule to an exclusion rule on the parent → the child/grandchild post is no longer gated, while posts outside the subtree still are.
5. Or run the unit tests: n test-php --filter test_content_rules (covers inclusion cascade, exclusion cascade, the one-directional guarantee, and non-hierarchical passthrough).

Rollout note

Because expansion is evaluation-time, on deploy every existing gate targeting a parent category recomputes its gated-post set with no migration step — this is a behavior-changing deploy, not a transparent fix. A per-site audit of the currently-live Access-Control sites (which gates expand and by how much) is tracked on NPPD-1670.

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully run tests with your changes locally? (Test_Content_Gates: 56 tests / 167 assertions green; PHPCS clean.)