Add a CommentOperation task type and a generic guarded-outcomes seam for pull operations

Follow-up to #3610077 (the UserOperation pull-based, work-item-free task-type family). Adds a per-outcome way to withhold outcomes that need the operator to open the operation first, and a reusable pull surface for hosts.

UserOperation gains guardedOutcomes(): a reason-agnostic seam listing outcomes withheld from a one-click inline signal, so a surface offers them only through the operation form. The plain operation guards nothing, so every outcome may be signalled inline.

Adds CommentOperation (orchestra_ui): a user operation whose comment-requiring outcomes (comment_outcomes) are guarded and chosen on a form that stores the operator comment in a configured variable, while the outcome stays the scalar the routing reads. InteractionOperation reuses the same seam for its requires-ui outcomes.

PendingActionsFinder gains forInstance(): the operations a user may act on within a single instance, so a host entity list can annotate a row with its own workflow operations, kept separate from the host's standard operations. The controller and the inline-signal endpoint ask the task type which outcomes are guarded rather than hard-coding it.