Works fine in my tests. Most likely your server has mod_security enabled and whatever HTML you're trying to add is triggering it. You can try setting it back to its default language key YOUR_REGISTRATION_IS_APPROVED_MESSAGE then use language overrides as shown below to override it.

www.joomlapolis.com/blog/kyle/18701-language-overrides-have-arrived

If it's mod_security doing it though it probably won't work there either and your only option is to contact your host or try using less security issue prone HTML (e.g. iframes or script tags in the message body).

1. the same email is being used on the production site on the same domain/server with no problems.

Have you tried using the language override usage instead of directly adding to CB > Configuration > Registration parameters?

2. Putting the same email in the Pending Body section doesn't do anything.

What do you mean it doesn't do anything? It doesn't error and reset the parameter back to its previous value?

how do i check mod_security?

Check server error logs or contact your host.