Authorize interaction resume by the node assignments, not the doorway; restore instance-scoped return display

Follow-up correcting the approach taken for the bearer-token resume gap in #3608216 (H3). That change token-scoped the webform handler's start return link so a party's instance-scoped capability token could not resume a later operator step. That was the wrong layer: it enforces authorization through link scoping, and it breaks any downstream step that consumes its token on completion. In the yoyaku booking example the payment step's return then points at the now-consumed payment token, so after paying the party lands on the dispatcher's neutral "nothing for you to do right now" instead of the booking's "Payment received" and "Awaiting confirmation" status.

The model

Separate two concerns the H3 change conflated:

• Authorization to resume a step is the node's assignments, checked against the current actor, not the doorway or the link scope. A node with no assignments is an open bearer step: holding a valid capability handle is enough (a party completing their own booking or payment step). A node with assignments requires the current actor to satisfy them (userCanAct), through any doorway, and the resume completes the node's work item so the inbox and the recorded outcome stay correct. So a party can never complete an operator step even holding an instance-scoped link, while an operator who reaches an assigned step through a bearer link (an email-a-manager-a-link pattern) still can, because they are an assignee.
• Display is which step the party is shown on return, and stays a display concern: the return link is instance-scoped where it was before H3 (a resume link stays scoped to its branch, unchanged), so after a consuming step the party lands on the run's current parked step and sees its render-only status message even when the step is not theirs to act on.

Work

• Route the resume so it dispatches on the node, not the injected gateway: an assigned node completes through the assignment path (userCanAct plus work-item completion) from either doorway; an unassigned node resumes the engine directly. Apply the same gate in the capability dispatcher's signal() and in the webform handler's resume.
• Revert the H3 start-return-link token-scoping back to instance-scoped (restore the original per-case scoping; a resume link stays token-scoped).
• Ensure the dispatcher shows a branch's current render-only status when a token-scoped link's token has been consumed by a completed step, rather than the neutral message.

Tests

• A party (non-assignee) is refused completing an assigned step but is shown its message; an assignee completing the same step through a bearer link succeeds.
• A consuming step (payment-style) returns the party to the current chain status, not the neutral message.

Supersedes the link-scoping mechanism from #3608216.