feat(12.1-01): declared record actions with an applicability rule

- pact.HasAdminRecordActions with AdminRecordAction (Applies, Run)
- config_form.yaml recordActions, compiled fail-loud
- show response meta.actions lists the permitted actions that apply
- POST .../{controller}/{id}/actions/{action}: record loaded and locked
  through the form scope; 404 out of scope, 409 when it does not apply
- RecordActions.vue with confirm and request flow (mounted by plan 02)
- roster fixture, smoke tests, OpenAPI, TS types, READMEs, docs

modules/cabana/contracts.go

@@ -83,6 +83,9 @@ type CompiledController struct {
 	// by name. They have their own namespace next to Actions; create and
 	// delete are reserved there too.
 	BulkActions map[string]pact.AdminBulkAction
+	// RecordActions are the controller's pact.HasAdminRecordActions entries
+	// keyed by name, a third namespace with the same reserved names.
+	RecordActions map[string]pact.AdminRecordAction
 
 	// scripts and styles are the controller's declared plugin JS and CSS,
 	// in declared order.