Add BaseLookupAction, permission_operation hook and ops-backed action bases

Three additions to the action bases. Independent of each other; one PR with separate commits.

1. BaseLookupAction + LookupActionProcessor. Converts an external key (name / canonical / access key) into the internal id. It carries no RBAC target because producing the target is what it does, so its gate is authentication only. SingleEntityActionProcessor._run() validates before it runs the service, so target_element() must be answerable at action construction time; a name-only action cannot satisfy that. Per-entity LookupKey types (about 10 shapes) carry composite keys such as (canonical, architecture) and (domain_name, email).

2. permission_operation() hook on BaseAction, defaulting to operation_type().to_permission_operation(). Lets the permission axis differ from the behavior axis. Needed for restore actions (RestoreVFolderFromTrash, RestoreArtifacts, BulkRestoreRolePresets): behavior is UPDATE, permission is SOFT_DELETE. Updates 7 call sites in actions/validators/rbac/{single_entity,bulk,scope,legacy}.py.

3. OpsBackendAction family plus shared EntityOpsResult / BatchOpsResult and a Data.entity_key() protocol. 344 of 535 service methods (64%) are pure pass-through, and 187 actions across 45 domains already carry ops specs as fields. Shared result types remove the per-domain result conversion entirely.

Done when: the three bases exist with tests, no domain code changed, type checks and pants tests pass.

JIRA Issue: BA-7142

Start with BaseAction and SingleEntityActionProcessor._run(), then inspect actions/validators/rbac/{single_entity,bulk,scope,legacy}.py for the permission-operation call sites. Review the existing action bases, service methods, ops specs, and type-check/test setup before separating the three additions. Done means the three bases, shared result types, entity_key protocol, and their tests exist with no domain changes, and type checks plus pants tests pass.

Written by the indexing model from the issue text.