feat(actions): config-driven action whitelist registry

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/fixtures/actions.test.json

@@ -0,0 +1,7 @@
+{
+  "hosts": { "ct100": "192.168.1.230", "z": "192.168.1.124" },
+  "actions": [
+    { "id": "restart-caddy-ct100", "label": "Restart Caddy", "kind": "service_restart", "host": "ct100", "service": "caddy", "tier": "safe" },
+    { "id": "stop-ct107", "label": "Stop CT107", "kind": "guest_power", "node": "z", "vmid": 107, "op": "stop", "tier": "risky" }
+  ]
+}