Make pending-action review/apply primitives frontend-product ready

[chubes4]

Goal

Harden generic pending-action review/apply primitives so product frontends can safely review generated or agent-proposed changes without going through wp-admin or CLI.

This supports Intelligence wiki review queues in Automattic/intelligence#817 and the Horse frontend review queue.

Required work

• Provide stable REST/ability surfaces for listing, reading, approving, rejecting, and applying pending actions.
• Include capability checks, owner/agent scope, side-effect summary, rollback/cleanup notes, and redacted parameter payloads.
• Make pending-action listing robust for all kinds, including existing failures like Extra-Chill/data-machine#2526.
• Preserve audit history for reviewer decisions.
• Keep review item semantics generic; domain-specific payloads belong to the caller.

Acceptance criteria

• A frontend product can safely present pending actions for human review.
• Pending actions are not limited to admin/CLI workflows.
• Sensitive payloads are redacted and side effects are explicit before approval.