Action framework foundation: lookup base, audit correctness, ops-backed generics

The action framework needs three corrections before the 506 remaining BaseAction migrations can proceed safely. Doing them first avoids reworking every domain twice and avoids writing wrong audit rows during the migration window.

Scope: framework only. No services// code is touched by this epic; domain migration stays under BA-6285 (service actions) and BA-6401 (repository DB access).

Design notes live in drafts/action-rbac-matrix/migration-design.md (hejo repo), backed by a full inventory: 638 concrete actions, 506 legacy, verified by runtime subclass enumeration.

JIRA Issue: BA-7141

Start with drafts/action-rbac-matrix/migration-design.md and the documented inventory of 638 concrete actions and 506 legacy actions. Use the framework scope in this issue to identify the three corrections; done means the framework is safe for the remaining BaseAction migrations without touching services// code.

Written by the indexing model from the issue text.