fix: default automation post author to the network bot account (#207)

[chubes4]

Part of honest content authorship at the source — extrachill-events#207 (Phase 2).

Problem

EventUpsert::resolvePostAuthor() fell through to WordPressSettingsResolver::getPostAuthor(), whose last-resort fallback is getFirstAdministratorId() → uid 1 (Chris). That's how ~3k automated events (blog 7) and 153 wire posts (blog 11) ended up authored under a human account — the misattribution the heatmap/points engines can't ignore.

Fix

Automation (no submission context, no explicit author config) now resolves to the network bot account via ec_get_network_bot_user_id() (extrachill-users) instead of the first-admin fallback.

Resolution order:

1. submission['user_id'] — human submitter (logged-in or Phase 1 anon-resolved). Unchanged.
2. Explicit config — system default_author_id, then per-handler post_author. Respected when set.
3. Network bot account via ec_get_network_bot_user_id() — the honest default. ← NEW
4. WordPressSettingsResolver (logged-in user / first admin) — last resort, only if the helper is unavailable.

Why this layer

data-machine-events is the EC integration layer, so it owns the EC bot-id default. This is layer-pure: the generic data-machine resolver is untouched, and the bot id is config-driven (no magic 32) via the helper in extrachill-users.

Behavior notes

• Existing per-flow post_author=32 handler configs keep working (explicit config still wins).
• This hardens the no-config case (15 event flows currently have post_author=0) so automation can never again default to a human admin.
• Forward-looking: NEW automated posts land on the bot; NEW submissions land on the submitter (Phase 1).

Verified

• php -l clean.
• No existing EventUpsertTest cases exercise resolvePostAuthor (verified); isolated private method.
• Composer/vendor not installed in the worktree, so the full PHPUnit suite wasn't run locally — recommend CI.

Sibling PRs (merge together)

• extrachill-users lint: php in data-machine-events (3) #167 — ec_get_network_bot_user_id() + create-user inputs (dependency)
• extrachill-events — Phase 1 + Phase 3 backfill

Conventional commits. No CHANGELOG / version bumps.

[homeboy-ci]

Homeboy Results — data-machine-events

Review audit

✅ review audit — passed

• audit — 7 finding(s)
• Total: 7 finding(s)

Deep dive: homeboy review audit data-machine-events --changed-since 3360e72

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-events-review-audit-homeboy-Linux-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-events-review-audit-homeboy-Linux-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine-events/actions/runs/28756029695

Tooling versions

• Homeboy CLI: homeboy 0.281.10+bb840a5b550b+f22ddb3
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: 68d84557
• Action: Extra-Chill/homeboy-action@v2