for checking the validity of a credit card on submit of a sales order, should that be done with suitescript or suiteflow? Or is this done natively within the payment processing integration?

Payment Processing should be doing that

100% should be done by the CC gateway and the corresponding credit card network

client has issues with some sales orders "pending fulfillment" for 80+ days open, is this an issue with payment processing then or is it something else?

fair chance your credit card authorization expired after 80 days