Fix 1.0.0-alpha7 audit findings: completion/timeout/migration concurrency, join-stall recovery, and re-offer notification

This tracks the fixes from the 1.0.0-alpha7 audit pass, plus the re-offer notification feature that pass surfaced. All changes are kernel-tested.

Engine correctness and concurrency

• Lost-completion race: two parallel branches ending under concurrent cron workers could each miss the other's consume under snapshot isolation, leaving the instance RUNNING with no live token and unrecoverable. Added a cron reconciliation backstop (an index-served anti-join over running instances with no live token) that completes them.
• Timeout-sweep poison pill: any throwing timeout action aborted the whole sweep and re-selected the same token every run. The per-token fire is now isolated, so one bad action cannot starve the sweep.
• Instance migration: the advance lock was wrong for synchronizing joins, and the instance was saved unlocked from a stale copy. Migration now runs per instance, re-reads committed state under the lock, and cannot resurrect a consumed token or a completed instance; bulk migration no longer holds locks across the whole batch.
• Stranded join recovery: a synchronizing join whose awaited branch was cancelled, with no timeout, hung forever. Added armJoinTimeouts(): making the join a timeout join (by editing the workflow or migrating) lets the sweep fire it with whatever arrived.
• A staged timer no longer fires its action against a task a concurrent signal already resumed.

Re-offer notification

• Escalating a timed-out task to a role or pool was silent. The task now carries a notify audience override recording the re-offer's audience, so notification follows the re-offer to the new pool, while claim eligibility stays on candidates. Stored as the audience recipe (plugin and settings), not resolved members, so a large pool costs no per-member storage and membership is read live at send time.

Smaller findings

• Bulk VBO complete records the acting operator, not the assignee.
• incident_raised audit event added to the schema, install defaults and the settings form.
• Audit permanent-bucket routing of variable and scope gated to the variable channel.
• Domain-to-tenant binding validated against existing tenants.
• orchestra_easy_email core_version_requirement corrected to ^11.3; Bcc-only Easy Email notifications are no longer dropped.
• WorkflowMigrateForm workflow parameter made non-nullable; documentation and README notes.

By design (documented, not code-changed)

• Enabling both mail channels double-sends: enable one. Documented in notification-delivery.
• orchestra_client and orchestra_server_api are not supported co-installed on one site.