Require signed pending-action authorization receipts

[chubes4]

Summary

• atomically claim pending actions before handler execution
• issue signed, expiring receipts bound to kind, operation, target, input, subject, workspace, resolver, and nonce
• reject wrong-kind, expired, consumed, rejected, or mismatched receipts
• retain durable and transient resolution audit fields after receipt consumption

Compatibility

Legacy handlers remain callable and receive the receipt as an additive third argument. Existing resolver response shapes remain unchanged.

How to test

1. Run php tests/signed-pending-action-resolution-smoke.php.
2. Run php tests/pending-action-resolver-contract-smoke.php.
3. Run php tests/pending-actions-agents-api-contract-smoke.php.
4. Run php tests/pending-action-store-durable-required-smoke.php.

Closes #2934