feat: email Socials reviewers signed approve and reject actions

[chubes4]

Dependency

Blocked by #40. Social approvals must use Data Machine PendingActionStore before email actions are added.

The original upstream blockers for observer dispatch and signed resolution URLs have landed.

Goal

Notify authorized Socials reviewers when a pending action is created and provide expiring signed approve/reject links.

Current platform requirements

• Send through the canonical Data Machine email ability/template system, not direct wp_mail().
• Use PendingActionStore signed resolution URLs.
• Record notification receipts so retries do not duplicate email.
• Resolve under the reviewer identity and re-check authorization at action time.
• Render enough caption/media/platform context to make a safe decision.

Acceptance criteria

• One review email is generated per pending action under retry/replay.
• Approve and reject links are signed, expiring, and single-resolution safe.
• Unauthorized or expired actions fail closed.
• Approval dispatches the existing Socials publish path and records its result.
• Rejection records reviewer and reason without publishing.
• Email and action receipts are auditable.