Release still-held bookings when a workflow instance is cancelled or failed

When a booking runs as an Orchestra workflow, the workflow starter clears each held booking's hold_expires so the workflow's node timeouts own the hold windows. If that instance is later cancelled or fails, its still-held lines must be released; otherwise cron skips them (it only expires holds that carry a deadline) and the seats stay withheld from sale.

The bridge already had a release handler, but it was registered on the orchestra_instance_update entity hook. Orchestra flips an instance to a terminal state with a guarded database write that bypasses entity save, so that hook never fires on cancel or fail: the release never ran and capacity leaked.

The fix moves the release to an InstanceEndedEvent subscriber, which Orchestra dispatches on every terminal path. It acts only on the cancelled and failed states and releases the order's remaining held lines, guarded so the reconciler does not treat the release as an out-of-band change. The previously skipped kernel test that asserts this is re-enabled.