feat(actions): agent_actions table + repo

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/db/agent_actions.test.js

@@ -0,0 +1,19 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { resetDb } from '../helpers/db.js';
+import { migrateUp } from '../../lib/db/migrate.js';
+import * as aa from '../../lib/db/repos/agent_actions.js';
+
+const owner = { kind: 'user', id: null };
+beforeAll(async () => { await resetDb(); await migrateUp(); });
+
+describe('agent_actions repo', () => {
+  it('creates pending, lists it, resolves once', async () => {
+    const row = await aa.create({ action_id: 'stop-ct107', tier: 'risky', params: {}, requested_by: owner });
+    expect(row.status).toBe('pending');
+    expect((await aa.listPending()).some(r => r.id === row.id)).toBe(true);
+    const done = await aa.resolve(row.id, 'executed', { ok: true }, owner);
+    expect(done.status).toBe('executed');
+    const again = await aa.resolve(row.id, 'rejected', null, owner);  // already resolved
+    expect(again).toBeUndefined();
+  });
+});