Rework the join and subprocess coordination into decide-then-apply collaborators (JoinCoordinator, SubprocessCoordinator)

Follow-up to #3608236: Extract a core execution service so the recovery and incident logic can move out and WorkflowEngine becomes a thin facade, second of two steps to take WorkflowExecutor below roughly 2000 lines; postponed on #3608366: Extract the loop-free leaf services from the WorkflowExecutor: token lineage, variables, deadline math, definition resolution, incident store, whose leaf services (VariableResolver, DeadlineCalculator) this builds on. The join machinery and the subprocess coordination cannot move mechanically: the loop calls them and they call the loop (tearDownCohort cancels stragglers, resumeParent resumes the parked parent), so a plain extraction would recreate the circular dependency #3608236: Extract a core execution service so the recovery and incident logic can move out and WorkflowEngine becomes a thin facade removed.

Split decision from action in both:

• JoinCoordinator: evaluates an arrival and returns an outcome value object: fire or wait, the deadline to arm on a wait, the siblings to consume, the surplus deadlines to clear, the merge to apply, the new parent for the continuing token, and whether an early fire must tear the cohort down. The executor applies those side effects inside its existing per-(instance, node) lock and transaction, exactly where they happen today.
• SubprocessCoordinator: computes the resume payload for a terminal child (the mapped result or the terminal status, its scope, and whether a retry re-launch should be armed instead) and owns armSubprocessRetry and relaunchDueSubprocess, which only make guarded database claims and read leaf services. The executor keeps the loop-bound tail: the atomic PARKED to ACTIVE claim and the resumeParked call.

Not a mechanical move: internal side-effect ordering changes, so the full join and subprocess matrix (JoinTest, JoinMergeTest, LoopJoinTest, ForkCohortTest, the three discriminator suites, JoinCancellationTest, JoinStallRecoveryTest, SignalIdempotencyTest, SubprocessTest) must stay green and the concurrency comments must move with the code.

Expected: roughly 440 lines net out of the executor, landing it just under 2000. One MR and one CI round.