fix: require durable pending action storage

[chubes4]

Summary

• Fails closed when PendingActionStore is used without durable database storage instead of silently writing transient approvals.
• Keeps transient storage available only behind explicit DATAMACHINE_PENDING_ACTION_TRANSIENT_FALLBACK opt-in for pure-PHP smoke tests / pre-table boot.
• Adds smoke coverage proving the default no-database path does not store transient approvals and documents the runtime boundary.

Closes #2221.

Verification

• php tests/pending-action-store-durable-required-smoke.php
• php tests/pending-actions-agents-api-contract-smoke.php
• php tests/pending-action-resolver-contract-smoke.php
• php tests/signed-pending-action-resolution-smoke.php
• composer exec phpcs -- inc/Engine/AI/Actions/PendingActionStore.php tests/pending-action-store-durable-required-smoke.php tests/pending-actions-agents-api-contract-smoke.php tests/pending-action-resolver-contract-smoke.php tests/signed-pending-action-resolution-smoke.php
• composer test (1294 tests, 0 failures, 3 skipped)

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Implemented the pending-action storage fallback containment, smoke coverage, verification, and PR drafting for Chris to review.

[homeboy-ci]

Homeboy Results — data-machine

Lint

✅ lint — passed

ℹ️ Full options: homeboy docs commands/lint
Deep dive: homeboy lint data-machine --changed-since cd06f9c

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-lint-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-lint-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/26350632284

Test

✅ test — passed

ℹ️ Auto-fix lint issues: homeboy refactor data-machine --from lint --write
ℹ️ Collect coverage: homeboy test data-machine --coverage
ℹ️ Pass args to test runner: homeboy test -- [args]
ℹ️ Full options: homeboy docs commands/test
Deep dive: homeboy test data-machine --changed-since cd06f9c

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-test-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-test-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/26350632284

Audit

✅ audit — passed

• requested_detectors — 3 finding(s)
• intra-method-duplication — 1 finding(s)
• Total: 4 finding(s)

Deep dive: homeboy audit data-machine --changed-since cd06f9c

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-audit-quality-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-audit-quality-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/26350632284

Tooling versions

• Homeboy CLI: homeboy 0.197.4+bd406d8c
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: dd23ee80
• Action: unknown@unknown