Move process instances to Structure, add a canonical link template and a per-tenant access permission

Process instances are runtime data, not workflow configuration, yet the instance UI lived under Configuration > Workflow next to the workflow definitions, and every instance route required the same administer orchestra permission as editing the configuration. This separates the two.

What changes:

• The instance list and detail move from /admin/config/workflow/orchestra/instances to /admin/structure/orchestra/instances, under a new Structure > Orchestra menu group.
• The detail route is renamed to the entity-canonical convention entity.orchestra_instance.canonical, and orchestra_ui declares the canonical link template on the instance via hook_entity_type_alter, so toUrl() works wherever the UI is installed and resolves through the route system, surviving an admin-path rename. The entity itself stays UI-agnostic.
• A new access orchestra instances permission gates the instance list, detail and the drive operations (signal, fire timer, run), distinct from administer orchestra, which now covers the workflow definitions. Both grant access, so administrators keep their reach.
• A tenant access check confines a scoped operator to the current tenant on the id-bearing routes, mirroring the incident access check, and the list query is scoped to the current tenant for a non-administrator, so the delete selection cannot reach another tenant.

Includes a unit test for the tenant access check and updates the functional tests to the new paths.