Reassign timeout action offers notify-only audiences, fatal on cron (poison pill)

Problem/Motivation

The Reassign timeout action ("Reassign or escalate") offers notify-only audiences as escalation targets, which then throw a fatal on the cron timeout sweep and wedge it as a poison pill.

The Assignment-to-Audience split (#3607392) switched this action to the broader orchestra.audience_manager. The "Escalate to" select is populated from audienceManager->getDefinitions() with no filter, so it lists notify-only audiences (Email, Email by variable) which extend AudienceBase and do NOT implement AssignmentInterface (no candidates()). The config saves silently, then onTimeout() calls candidates() and throws a fatal.

The cron path catches, rolls back and re-throws; because the timer clears its deadline inside the rolled-back transaction, the rollback restores the deadline and the same token re-fires on every run: a persistent poison pill that blocks the whole timeout sweep until the config is fixed.

Steps to reproduce

1. On a human node, add a "Reassign or escalate" timer and select "Email address" (or "Email by variable") as the escalate-to audience. It saves without error.
2. Let the timer fall due and run cron.
3. The sweep throws a "Call to undefined method Email::candidates()" fatal and re-fires the same token on every subsequent run.

Proposed resolution

Filter the option list in buildConfigurationForm() to definitions whose class is an AssignmentInterface (mirroring Assignments::pluginOptions()), guard onTimeout() to skip a non-assignment plugin before calling candidates(), and add a validateConfigurationForm() rejecting a non-assignment selection so bad config cannot be saved. Adds kernel tests.