Add signed pending action resolution URLs

[chubes4]

Summary

• Adds datamachine/sign-pending-action-resolution to generate signed approve/reject URLs for pending actions.
• Adds public GET /datamachine/v1/actions/resolve-by-token?t=... resolution via HMAC tokens, expiry checks, and existing pending-action resolver flow.
• Documents the signed URL surface and covers token generation, resolution, and secret rotation with smoke tests.

Closes #1929.

Testing

• php tests/signed-pending-action-resolution-smoke.php
• php tests/pending-actions-agents-api-contract-smoke.php
• homeboy lint --path /Users/chubes/Developer/data-machine@feat-signed-pending-action-urls --extension wordpress --changed-since origin/main
• homeboy test --path /Users/chubes/Developer/data-machine@feat-signed-pending-action-urls --extension wordpress --changed-since origin/main
• homeboy audit --path /Users/chubes/Developer/data-machine@feat-signed-pending-action-urls --extension wordpress --changed-since origin/main
• git diff --check

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Implementing the signed pending-action URL ability, REST adapter, documentation, smoke coverage, and local validation; Chris remains responsible for review and merge decisions.

[homeboy-ci]

Homeboy Results — data-machine

Lint

✅ lint — passed

ℹ️ Full options: homeboy docs commands/lint
Deep dive: homeboy lint data-machine --changed-since bad34b7

Test

✅ test — passed

ℹ️ Auto-fix lint issues: homeboy refactor data-machine --from lint --write
ℹ️ Collect coverage: homeboy test data-machine --coverage
ℹ️ Pass args to test runner: homeboy test -- [args]
ℹ️ Full options: homeboy docs commands/test
Deep dive: homeboy test data-machine --changed-since bad34b7

Audit

✅ audit — passed

• requested_detectors — 34 finding(s)
• test_coverage — 12 finding(s)
• dead_code — 10 finding(s)
• intra-method-duplication — 6 finding(s)
• parallel-implementation — 3 finding(s)
• structural — 2 finding(s)
• Flows — 1 finding(s)
• duplication — 1 finding(s)
• Total: 69 finding(s)

Deep dive: homeboy audit data-machine --changed-since bad34b7

Tooling versions

• Homeboy CLI: homeboy 0.188.10+c4b65148
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: e611a16e
• Action: unknown@unknown