Unify human-node action handoff on interactions and retire handler_url

Follow-up to the UserOperation task-type family work. That effort adds a pull-based operation family (UserOperation, InteractionOperation) whose action UI is reached with no handler_url: the operation form is built in (outcome buttons, or the attached interaction's respond()). This issue brings the inbox task family to the same shape and retires the parallel handler_url mechanism.

Problem

The inbox hands a work item off to a form through the node handler_url config, with HandlerUrlInterface supplying a built-in default. This duplicates the interaction mechanism: respond() plus a gateway already is the general "render a UI to act on a parked token and resume it", and it already runs across the bearer and inbox-authenticated contexts. handler_url exists only because a bare user task has no built-in action form, so the author points it at an arbitrary one such as ReviewHandlerForm.

Target

• A basic signal task type in core: outcomes plus assignments plus a built-in outcome-buttons form, no interaction, no handler_url. It is the inbox mirror of UserOperation.
• InteractionTask becomes the basic task plus an attached interaction (respond()).
• EntityFormTask specializes InteractionTask: its handoff is an interaction that opens the attached entity form, not a handler_url default.
• Remove handler_url, HandlerUrlInterface and ReviewHandlerForm.
• Unify the action form on the interaction mechanism (respond() plus a gateway) shared across the bearer, inbox and operation gateways, so there is one way a human acts on a parked token.

Migration and BC

• Shipped workflow configs that set handler_url (the example booking review nodes point at /booking/order-review) migrate to an attached interaction, with an update path that rewrites those nodes.
• The basic task keeps the same outcomes, result_variable, result_scope, completer_variable and assignments config, so a plain user task is unaffected beyond gaining a built-in form.
• Third-party nodes that set handler_url need a documented migration to an interaction.

Relation

Builds on the shared core pieces introduced with the UserOperation family: HumanNodeConfigTrait, AssignmentMatcher, OutcomeResult, and the assignment-gated operation form and gateway. Those already put the built-in action form and the outcome and completer contract in core, so this issue is mostly moving the inbox task types onto them and deleting handler_url.

What landed (MR !315)

guardedOutcomes() is lifted to a shared HumanNodeInterface seam that both the inbox one-click list and the pull surface honor.

• A CommentTask (inbox) and a Comment interaction (reusable on any interaction node) collect a comment plus one button per outcome; a review is only this with approved/rejected outcomes.
• The entity_form task type is replaced by an EntityInteraction (orchestra_content), attachable to an interaction task.
• One pending-actions surface lists inbox tasks alongside pull operations through tagged per-family handlers, with a configurable act_label (defaulting to the node label) and an act link only when a node has a page to open.
• The InteractionTaskForm and InteractionOperationForm host forms are deleted: an interaction owns its own completion, run by a thin identity dispatcher under the assignee identity.

handler_url is fully retired: HandlerUrlInterface, both ReviewHandlerForms, the review-handler / process / complete-remote routes, the WorkItemManager handoff and signed remote-callback path, and the UserTask handler_url / action_title config are removed. action_title becomes the general, translatable act_label; external systems integrate through the interaction bearer gateway instead of a signed POST callback. Example workflows are migrated, docs updated, and French translations added.