feat(actions): config-driven action whitelist registry

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/actions/registry.test.js

@@ -0,0 +1,23 @@
+import { describe, it, expect } from 'vitest';
+import { fileURLToPath } from 'url';
+import { loadActions } from '../../lib/actions/registry.js';
+
+const FIX = fileURLToPath(new URL('../fixtures/actions.test.json', import.meta.url));
+
+describe('action registry', () => {
+  it('loads + indexes valid actions and resolves host ip', () => {
+    const reg = loadActions(FIX);
+    expect(reg.list().map(a => a.id).sort()).toEqual(['restart-caddy-ct100', 'stop-ct107']);
+    expect(reg.get('restart-caddy-ct100').tier).toBe('safe');
+    expect(reg.hostIp('ct100')).toBe('192.168.1.230');
+    expect(reg.get('nope')).toBeUndefined();
+  });
+  it('rejects an action with a bad id or unknown kind/tier', () => {
+    expect(() => loadActions(null, { hosts: {}, actions: [{ id: 'bad id', kind: 'service_restart', tier: 'safe' }] }))
+      .toThrow(/invalid action id/i);
+    expect(() => loadActions(null, { hosts: {}, actions: [{ id: 'x', kind: 'nuke', tier: 'safe' }] }))
+      .toThrow(/unknown kind/i);
+    expect(() => loadActions(null, { hosts: {}, actions: [{ id: 'x', kind: 'guest_power', op: 'stop', tier: 'evil' }] }))
+      .toThrow(/invalid tier/i);
+  });
+});