orb(chat): confirmed action-dispatch through the write-safety chokepoints — pause, dry-run, re-gate, approval release, manual-review release

[JSONbored]

Context

Part of the ORB maintainer chat platform epic; implements the action side per the spec sub-issue's recorded decisions (do not start before that spec closes). The contributor dashboard already proved the confirmed-dispatch pattern (#6521, #6838, #6839): the model proposes, the human confirms, the dispatch is server-side and audited.

Hard constraints

• ⚠️ Every dispatch routes through the existing write-safety chokepoints — resolveAgentActionMode and, for any GitHub write, makeInstallationOctokit(env, token, mode). A raw fetch() write anywhere in this feature is a defect. test/unit/no-direct-octokit.test.ts's invariant applies unchanged.
• ⚠️ Two-phase dispatch, always: propose (chat) → explicit confirm (UI affordance) → server-side execute. No auto-execution from model output under any phrasing.
• ⚠️ Global freeze is not chat-actionable. Freeze state renders read-only; kill-switch ratchet semantics stay outside this surface.

Requirements

1. Implement the spec-confirmed action set. Candidates: per-repo agent pause/resume; dry-run toggle; force re-gate (reusing the feat(queue): wire an admin trigger for agent-regate-pr force re-gates #8958 admin trigger, not a parallel path); approval-queue release; human-attributed manual-review release — the human-provenance removal path that autonomous code deliberately lacks. Each action declares its authz tier from the spec's matrix.
2. Every dispatch writes an audit event carrying the actor identity, the conversation/message reference, and the pre/post state — a chat dispatch must be at least as traceable as the equivalent panel/API action.
3. Dispatches respect the current action mode: under pause/dry-run/freeze, an action that would be suppressed for the agent is either refused with the reason or (where the spec says so, e.g. un-pausing) explicitly permitted — enumerated per action, no general rule assumed.
4. Failure surfaces in-conversation with the audited reason; no silent no-ops.

Deliverables

• Action registry + confirm-flow endpoints, feature-flagged off by default.
• Tests: authz-deny per action per tier; suppression behavior per mode per action; audit-event emission assertions; the no-raw-write invariant.
• Docs: action catalog with authz tier and mode behavior, as-built.

Expected outcome

"Pause the agent on this repo" and "re-gate #123" are safe, confirmed, audited chat actions — with the write-safety guarantees identical to every other actuation path in the system.

[linear-code]

JSO-6350