Improve the process instances list: version column, sortable columns, and filters

Three related improvements to the process instances list (admin/structure/orchestra/instances), so operators can find and reason about instances at scale.

What this adds

• Version column: the immutable version each instance is pinned to, marked "N (current)" when it matches the workflow's published version (consistent with the Versions page), or "Live" for an unpinned instance (legacy, or a workflow with versioning off).
• Sortable columns: Instance, Workflow, Version, Status and Tenant sort through the entity query's tableSort(), composing with the pager; newest-first by default.
• Filter: a collapsed "Filter" above the list (Workflow, Status, and, for administrators, Tenant) with an active-filter chip bar and Apply/Reset. The filter is a GET form, so its fields live in the URL and a filtered view is shareable and pages and sorts cleanly.

Reusable filter base

The filter is built on a new orchestra_ui FilterFormBase (a collapsed GET "Filter" with an active-filter chip bar and a Reset link) so other orchestra admin lists can adopt the same filter with a small subclass. InstanceFilterForm is the first consumer. The instances route now renders the GET filter form above the existing POST bulk list through a controller, since a GET filter cannot nest inside the POST form.

Tests

A kernel test covers the version cell (current and Live), the sortable header, the workflow and status query-parameter filtering, and the filter form's fields and active chip. The existing bulk tenant-access test still passes.