feat: add cross-site events-by-artist LIST ability

[chubes4]

What

Registers a new WordPress Ability data-machine-events/events-by-artist that returns the LIST of events tagged to an artist term on the events site, split into upcoming / past, callable from any site regardless of which plugins are locally active.

Closes #408. The companion consumer change (rewiring the artist-platform Shows section to call this ability) lives in extrachill-artist-platform.

The bug it fixes

The artist profile hub (artist.extrachill.com, blog 4) added a "Shows" section that called data_machine_events_query_events() after switch_to_blog(events). That silently renders nothing: switch_to_blog() changes the DB context, not the loaded PHP. On the artist site only extrachill-artist-platform is active — data-machine-events functions don't exist there, so the function_exists-guarded section shows nothing.

The correct cross-site pattern is an Ability (network-registered, callable anywhere), mirroring extrachill-multisite TaxonomyCountAbilities — but returning an event LIST, not just counts.

Input / output shape

Input:

{ artist_slug (required string),
  scope (optional: upcoming|past|all, default all),
  limit (optional int, per-scope, default 12) }

Output — plain structured data, no markup:

{ artist_slug, found,
  upcoming: [ {event_id, title, permalink, venue_name, date_iso, date_display, time_display, timing} ],
  past:     [ ... ] }

Permalinks, titles, venue names, and formatted date/time strings are pre-resolved while still in events-blog context, because the consumer renders on a different blog and cannot resolve them afterward.

How it works

• Registers on wp_abilities_api_init (with the did_action guard the sibling abilities use), category datamachine-events-events.
• switch_to_blog( events blog ) internally, paired with restore_current_blog() in a finally block — context never leaks even on error.
• Events blog ID resolved via ec_get_blog_id('events') when available, behind a data_machine_events_events_blog_id filter so the generic plugin never hard-codes a site ID (keeps layer purity; supports non-EC installs / tests).
• Resolves the artist term by slug, then reads the datamachine_event_dates table joined to term_relationships/term_taxonomy directly via $wpdb, splitting upcoming (start_datetime >= now, ASC) vs past (< now, DESC), post_status = 'publish', LIMIT per scope.
• Each event is hydrated into a plain presentational array (title/permalink/venue/date/time), HTML-entity-decoded for cross-blog rendering. Midnight start time is treated as "no known time" and omits time_display.

Layer purity & standing rules

• Returns structured data, not HTML — the consumer (artist platform) owns presentation.
• No consumer-specific identity in the ability logic beyond the taxonomy/slug/site contract; the site ID comes from a filterable helper, not a literal.
• No reflexive back-compat; function_exists('ec_get_blog_id') graceful-degradation guard retained.

Verification

• homeboy lint — phpstan level 7 passes; the new file EventsByArtistAbilities.php produces zero phpcs findings. (The repo's overall phpcs step is red on pre-existing debt across ~40 unrelated files, including the sibling UpcomingCountAbilities.php; none of it is from this change.)
• php -l clean on both changed files.
• homeboy test could not run: the host's WP Codebox test runner is currently broken (wp-codebox found, but no candidate passed 'wp-codebox --version') — an environment issue, not a test failure. No local vendor PHPUnit is available in the worktree.

Build to PR only — no deploy/release, no CHANGELOG edits, no version bumps.

[homeboy-ci]

Homeboy Results — data-machine-events

Audit

✅ audit — passed

• audit — 3 finding(s)
• Total: 3 finding(s)

Deep dive: homeboy audit data-machine-events --changed-since b054c8d

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-events-audit-homeboy-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-events-audit-homeboy-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine-events/actions/runs/28708709382

Tooling versions

• Homeboy CLI: homeboy 0.280.13+89fee93c89fb+4d0eaca
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: aef559f8
• Action: Extra-Chill/homeboy-action@v2