[AlertZero] Add isolate host action workflow

[semd]

Summary

part of: https://github.com/elastic/security-team/issues/19292

• Adds a managed AlertZero action workflow (system-alertzero-action-isolate-host) as the example contain action for Defend to copy: isolate via POST /api/endpoint/action/isolate, then poll GET /api/endpoint/action/{id} until complete (or ~30 minutes).
• Catalog metadata matches elastic/security-team#19292: category: contain, impact: high, approvalPolicy: always-gate. Input is actionInput.endpoint_ids only (agent ids, not hostnames).
• Probes GET action details before isolating so a missing Actions log privilege fails closed instead of isolating a host we cannot wait on.
• Lives under alertzero/actions/defend/ so future Defend response actions inherit CODEOWNERS @elastic/security-defend-workflows + @elastic/workflows-eng (create-detection-rule stays in actions/).
• Moves the generic action-workflow contract test next to action_workflow.ts (managed/action_workflows.test.ts).

Test plan

• Confirm GET /internal/alertzero/actions lists Isolate host after Kibana start (tag action).
• Create a proposal with actionWorkflowId: system-alertzero-action-isolate-host and actionInput.endpoint_ids: [<agent id>]; approve it.
• Approver with Host isolation and Actions log: isolate is sent, poll completes, proposal succeeds.
• Approver with Host isolation without Actions log: workflow fails on the privilege probe; host is not isolated.
• CODEOWNERS for managed/definitions/alertzero/actions/defend lists @elastic/security-defend-workflows and @elastic/workflows-eng.
• Jest: node scripts/jest src/platform/packages/shared/kbn-workflows/managed/action_workflows.test.ts src/platform/packages/shared/kbn-workflows/managed/managed_workflow_definitions.test.ts

Made with Cursor

[ymao1]

👋 Hey! I opened this PR as well #291168 but I can close in favor of yours if that makes sense

[kibanamachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: ac63952
• Build duration: 53 mins
• Storybooks Preview

Failed CI Steps

• FTR Configs #66
• Scout Test Run Builder
• Scout Lane #24 - stateful-classic / default
• Scout Lane #114 - serverless-observability_complete / default

Metrics [docs]

✅ unchanged

Test Failures

• [job] [logs] Scout Lane #114 - serverless-observability_complete / default / local-serverless-observability_complete - Synthetics manage rules privilege - lets a read user with can_manage_rules enable default alerting
• [job] [logs] Scout Lane #24 - stateful-classic / default / local-stateful-classic - Synthetics manage rules privilege - lets a read user with can_manage_rules enable default alerting

History

• 💛 Build #502291 was flaky 4b5da27

[semd]

Closing in favor of #291168