Fixes ACTLOG-57
Requires 215994-ghe-Automattic/wpcom to be deployed first to prevent WPcom test failures.

Proposed changes

Adds a Jetpack Sync helper class for creating custom customer-visible Activity Log entries.

• Introduce Automattic\Jetpack\Sync\Activity_Log_Event as the API for creating custom Activity Log events.
• Register a non-public jp_act_log_event CPT for transporting custom Activity Log event payloads through Sync.
• Store the event payload as JSON in post_content.
• Validate and sanitize event input:
  • required title and content
  • optional source
  • optional severity limited to info, success, warning, or error
• Normalize REST create requests like { title, content, source, severity } into the canonical JSON payload.
• Restrict REST access to trusted/admin contexts and block edit/delete-style CPT operations.
• Route valid custom event posts through the existing jetpack_published_post Sync pipeline.
• Allow normal save/delete Sync actions for jp_act_log_event posts so remote/cache DB state stays consistent.
• Reuse the custom event payload validation for direct jp_act_log_event inserts so invalid severity values, empty sanitized content, and malformed payloads are not enqueued through jetpack_published_post.
• Prevent Activity Log event posts from being publicized or included in Jetpack sitemaps.
• Add Sync package tests for validation, sanitization, CPT creation, and enqueue behavior.

Related product discussion/links

• This is part of an RSM project to add custom entries to the Activity Log. See Linear link above for more.

• Requires the matching WPcom Activity Log handling in 215249-ghe-Automattic/wpcom, which translates valid jp_act_log_event posts into custom_event__created entries and prevents malformed payloads from falling through as generic post publish events.

Does this pull request change what data or activity we track or use?

No.

Testing instructions

To test, apply this PR on a test site using the Jetpack Beta tester plugin, for the Jetpack plugin (or apply the PR if testing locally).

• Using a code snippets plugin, add the following snippet: 3b2d3-pb
• Visit yoursite.com/wp-admin/?test_activity_log=1
• You may want to log the args on the WPcom end to confirm they're received and with the right content, eg. under case 'jetpack_published_post': in Jetpack_Sync_Server_Replicator
• Alternatively, apply 215249-ghe-Automattic/wpcom, and ensure your Jetpack site is API sandboxed. Then, follow the same steps as above, and you should be able to view the Activity Log entries

To test the endpoint via WPcom:

• With 215249-ghe-Automattic/wpcom applied as well as this PR for a Jetpack API sandboxed site, open up wpsh and run the following:

$blog_id = YOURBLOGID;
$rest_url = sprintf( '%s/?rest_route=%s', Jetpack_Data::get_client( $blog_id )->siteurl, '/wp/v2/activity-log-events' );
$response = Jetpack_Client::remote_request( [ 'url' => esc_url_raw( $rest_url ), 'blog_id' => $blog_id, 'user_id' => (int) wpcom_get_blog_owner( $blog_id ), 'method' => 'POST', 'timeout' => 30, 'headers' => [ 'Content-Type' => 'application/json' ] ], wp_json_encode( [ 'title' => 'wpsh option-2 test', 'content' => 'Hello from wp/v2.', 'severity' => 'info', 'source' => 'mc'] ) );

You can run the following in wpsh to confirm a response, or wait for the entry to show on the AL:

echo wp_remote_retrieve_body( $response );

To confirm that unauthenticated rrequests are not allowed, run the same test but remove the user_id. You should get an invalid_user_permission_activity_log_event 401 response.

For Simple sites, testing via the Developer API console may be easier here: