fix: route pipeline CSV imports through ability

[chubes4]

Summary

• route Pipeline Builder CSV imports through WordPress core's REST ability runner and consume the import ability's direct success, imported, and count result
• preserve malformed CSV as a typed HTTP 400 before writes while retaining HTTP 500 semantics for operational import failures
• replace the stale fuzz CSV with the canonical versioned shape, remove dead custom POST import arguments, and add focused endpoint/ability coverage
• remove two proven dead constructs in the touched pipelines controller so changed-file level-7 PHPStan remains clean

Call Chain

Old:
ImportTab -> importPipelines() -> custom POST /datamachine/v1/pipelines with batch-import fields -> Pipelines::handle_create_pipeline() -> rejects missing pipeline_name or delegates only to datamachine/create-pipeline.

New:
ImportTab -> importPipelines() -> core POST /wp-abilities/v1/abilities/datamachine/import-pipelines/run with an input object -> datamachine/import-pipelines -> ImportExportAbility::executeImport() -> ImportExport::handle_import().

datamachine/import-pipelines is the existing owning primitive: it is registered with show_in_rest: true, delegates to the canonical importer, and defines the direct success, imported, and count contract. No custom import route or wrapper was added.

CSV Contract

The fixture now uses canonical Data Machine CSV 1.0 with the 10-column header:

format_version,row_type,pipeline_id,pipeline_name,step_position,step_type,step_config,flow_id,flow_name,settings
1.0,pipeline,3255,Fuzz 3219 import,,,,,,

Malformed parser input returns invalid_pipeline_csv with HTTP 400. Parsing completes before the first write, and tests assert the malformed pipeline is not persisted. Failures outside parser validation still return pipeline_import_failed with HTTP 500 rather than being mislabeled as client errors.

Verification

• full managed WordPress suite: 1,533 total, 1,501 passed, 32 skipped, 0 failed
• focused PipelinesEndpointTest: 7 passed
• focused ImportExportStepConfigTest: 6 passed
• changed-scope lint: PHPCS, ESLint, and level-7 PHPStan passed with zero findings
• changed-scope architecture audit: zero introduced findings
• fixture contract: passed
• production build: passed
• runtime-backed fixture reached and passed the valid canonical import and malformed/no-write cases using a temporary explicit source override; the committed fixture retains portable ../.. paths. The public runner's nested input-file path bug is tracked as run-fuzz-suite resolves runtime requirements against cwd instead of input file Automattic/wp-codebox#2385.

Fixes #3255

AI Assistance

OpenAI GPT-5.6 Sol via OpenCode investigated the existing contracts, implemented and reviewed the patch, and ran verification. Chris Huber remains responsible for review and merge.