Pre-1.0.0-alpha11 hardening: anonymous page-cache safety, task-signal guard, client https allowlist, and missing tests

Pre-1.0.0-alpha11 hardening bundle from a fresh audit pass. One MR, each item with a test.

Security and correctness

• The interaction dispatcher step and comment pages set render max-age 0, which the dynamic page cache honors but core's internal page cache ignores, so an anonymous bearer-link visitor could be served a stale step (the #3609153 bug, on the route's main audience). Add no_cache to the orchestra_interaction.step and .comment routes.
• The identity task signal route resumed any outcome from the URL: it neither refused a guarded outcome (the operation twin already does) nor caught the exception a deconfigured outcome raises, so a crafted or stale outcome was an uncaught 500. Mirror the operation controller: refuse guarded outcomes and catch, falling through to the "no longer open" warning.
• CommentForm, the embedded decision for every review interaction, resumed without catching that same exception, a 500 when the outcome set changed between render and submit. Catch it.
• ContextMessages rendered an admin-configured label through Markup without escaping it. Escape the literal label before token replacement.
• The client enforced https on the settings form only, so a config import could downgrade the OAuth credential channel to plain http. Add a settings.php orchestra_client.allow_http_hosts allowlist (OR-ed with loopback) and re-check the policy at request time in the token provider and the client, so an import cannot bypass the form.

Test coverage

• Client https enforcement, including the new allow_http_hosts allowlist.
• Stored-card cleanup when a run ends (a privacy path that was untested).
• Interaction config-schema strict-save coverage.
• The task-signal guard and the CommentForm guard.

Documentation and translation

• Drop the retired HandlerUrlInterface from the extension points, document ReviewInteractionBase, fix em-dashes, and complete the French translations touched by recent features.