Fix post-alpha8 delta-audit findings: confine stale-handle resume to its own step, and list/translation/docs/hardening follow-ups

A delta audit of the six commits that landed after the pre-alpha9 full audit (0eca894, abc1682, 465fd49, c464836, 2a4bbbd, c410edb) surfaced one HIGH correctness cluster, one behavior regression, and a set of translation, docs, and hardening follow-ups. This issue fixes all of them in one MR before tagging alpha9. All six touched kernel suites stay green.

H1 (High): stale bound-submission re-edit over-resolves

Since 465fd49 + c464836, a re-edit of a bound webform submission no longer means "the run moved on, nothing resumes". InteractionResolver::liveBranchToken() lost node confinement on the consumed-handle path, and the node fallback fires in exactly the states where it is sibling-unsafe. Three constructible variants, one root cause:

• (a) Later-node resume: the branch advanced to a later parked step; the re-edit resolves that later token via the chain path, overwrites the values variable with stale data, and resumes it with result "submitted" which its flows do not define, so the run misroutes or stalls.
• (b) Assigned later step: CapabilityGateway::resume() refuses it, but storeSubmission() already overwrote the values variable before the refusal, so a party can silently modify data an operator is reviewing.
• (c) Sibling resume via the node fallback: a dead branch (nothing parked in the chain) or a fork-stop (both siblings advanced past a shared step) makes the fallback pick a sibling parked on the shared node.

Fix: in the resume path, when the named token is consumed, return the in-chain parked token only when it is parked on the same node as the consumed token (the genuine loop re-entry), otherwise NULL, and never take the node fallback for resume. Gate storeSubmission() behind the resumer authorize() on the resolved token so a refused resume writes nothing.

M1 (Medium): return-to-workflow link can scope to a sibling branch step

Same root cause as H1c on the return-link path. nextBranchToken() now delegates to liveBranchToken() and gains the node fallback the old chain-only code did not have, so it can mint a branch-scoped link pointing at a sibling step. Resolved by giving the resolver a same-node resume method and a separate chain-scoped-any-node method for the return link (the old behavior).

M2 (Medium): status column shows raw machine names

The instances list renders the raw status ("completed") while the same page filter shows the translated label. One labelled status map is now shared by both the list and the filter.

M3 (Medium): new UI strings missing from French translations

orchestra_ui fr.po lacked the new strings (Live, "@version (current)", and the status labels). Added, with natural French wording aligned to the module catalog.

M4 (Medium): docs stale or missing for the delta features

• docs/webform.md re-edit gotcha is rewritten to match the fixed code.
• docs/versioning.md documents the new Version column and the "(current)" marking.
• docs/multi-tenancy.md notes the tenant filter is admin-only.
• docs/timers.md documents the 1-hour defer backoff for unavailable definitions or nodes and its log message.

Lows

• L1: the workflow filter now scopes options to the operator tenant (plus shared) for non-admins, instead of disclosing every workflow label.
• L2: the GET filter form strips core form_build_id/form_id/op elements so filter and sort URLs stay clean.
• L3: the definition-unresolvable defer is moved inside the per-token try block so a throwing UPDATE cannot abort the rest of the batch; the node-missing defer path gains a test.

Tests

Added coverage for: later-node re-edit is a no-op, assigned later step re-edit writes nothing, dead-branch re-submit resolves nothing (sibling untouched), both-siblings-advanced re-submit resolves own branch or NULL, and the node-missing defer advances the deadline by the backoff. All six touched kernel suites pass locally.