Pre-1.0.0-alpha10 hardening: pending-actions performance, security, robustness, docs and tests

A pre-alpha10 audit pass (security, performance, code quality, documentation, test coverage, release readiness) across the diff since 1.0.0-alpha9, bundling the safe must/should fixes into one hardening change.

Performance (the new pending-actions surface):

• Memoize the viewer assignment tokens per account in AssignmentMatcher, and the task-type plugin per node in PendingActionsFinder, so the finder no longer rebuilds the audience-plugin set and the plugin per parked token (this also speeds the inbox).
• Resolve a whole page of the instances list in one token query (PendingActionsFinder::forInstances) instead of one query per row.

Security (defense-in-depth):

• Escape the configured act_label template before FormattableMarkup, so a config editor or translator cannot inject markup into the label every operator sees (placeholders still fill).
• Strip CR/LF from Easy Email subject token replacements, so a process variable cannot inject mail headers.

Robustness:

• Catch the outcome-no-longer-valid case at the operation form, the inbox task form and the interaction operation controller, so an outcome set changing between render and submit shows "no longer available" instead of a 500.
• OperationGateway::stepUrl() throws a clear LogicException (operations are always token-scoped) rather than emit a broken route; small consistency fixes in InteractionOperation and VariableResolver.

Packaging: add drupal/kessai to composer suggest; mark orchestra_payment lifecycle experimental (its only backend is dev-only); normalize orchestra_interaction_test core_version_requirement to ^11.3.

Documentation and translations: correct the README human-tasks description (handler_url was retired) and add the three missing modules to the table; correct the Easy Email template cascade to the four-dimension (tenant/workflow/type/suffix) form; document the pull-based operation family; add the alpha10 features to the roadmap Built list; natural French for the new UserOperation and CommentOperation strings.

Tests: new kernel coverage for OperationAccessCheck (assignee-only, consumed token, wrong tenant) and for the guarded-outcome bypass being refused server-side; make the "unmarked failure is dead-lettered, not retried" assertion discriminating.

Deferred to follow-ups: a pager / candidate index for the unbounded pending-actions scan (architectural), an explicit FatalException classification test, and a functional test for the pull-operation UI.