Standardize the payment lifecycle (authorized/captured/cancelled) and record checkout authorizations instead of capturing inline

The Worldline finalizer captures the checkout inline, about two seconds after the authorization, which is exactly when the provider returns the transient ACTION_NOT_ALLOWED_ON_TRANSACTION error. The failure is swallowed and the payment is still recorded as taken, even though the money was never captured.

This standardizes the payment lifecycle onto the usual authorize then capture model and moves the capture off the request path:

• States: one "money taken" state, captured. "paid" is removed, "held" becomes "authorized", "released" becomes "cancelled". The deposit record kind becomes "deposit" (was "hold").
• Manager: one verb set, authorize(), capture(), cancel(), refund(), fail(), plus the authorizeToken() and chargeToken() factories. capture() captures an authorized payment or records a completed direct sale; a new authorize() records an existing pending checkout as authorized.
• Gateway plugin: release() becomes cancel().
• Finalizer: an authorized checkout (PENDING_MERCHANT) is recorded authorized rather than captured inline; a completed checkout (COMPLETED) is recorded captured. The capture is left to the consumer, for example a workflow settle step, where it can wait and retry the transient race. Idempotent against multiple, duplicate or out of order webhooks via the pending-state guard.

Pre 1.0, so the state values are renamed outright with no backward-compatibility shim. Kernel tests, phpcs and phpstan pass.