Name methods the way core does, rename ReadScope to ReadAccess, and follow the same renames in kessai, audit_trail and domain_extras

The core-vocabulary audit in #3618935: Name things the way Drupal core does: canceled, core's *Hooks suffix, summary() over explain(), delete() over forget(), action over act left one finding open as a decision rather than a rename: method names that carry no verb, so a reader cannot tell whether one asks a question, states a predicate or performs an action.

Measured on 1.x: orchestra begins 15.8% of its method names with get, against core's 26.1%, and 23.1% are accessor-shaped (get, set, is, has) against core's 38.4%. 341 of its own method names begin with no verb at all: attachmentFor(), stepUrl(), guardedOutcomes(), holderLabel(), lineageIds(), instanceCancel(), componentConfig().

That audit was explicit that this cannot be swept, and it is right: each name is a per-method judgement, and blind get prefixing states the opposite of the truth. currentVersion() and publishedVersion() sit next to each other and only one of them may create a version, so that one becomes ensureCurrentVersion(), not getCurrentVersion(). incidentCancel() returns a RedirectResponse and performs the cancel, so it becomes cancelIncident(). activeByTokens() loads, so it becomes loadActiveByTokens(), matching the loadActiveByToken() beside it.

Kept as they are: the domain's own verbs (fire, resume, claim, park, drain, sweep), the third-person predicates core also uses (applies, exists, belongs), the contract methods of core and of the modules orchestra implements, including the OOP hook methods named after their hook, and static factories in core's AccessResult::allowed() shape, which is what CapabilityOutcome::messages() and nothing() are.

Config keys change. ReadScope becomes ReadAccess, and with it the stored keys read_scope and instance_read_scope become read_access and instance_read_access. There are no update hooks before 1.0, so an existing site's saved settings, workflow overrides and tenant overrides have to be migrated or the module reinstalled.

Two dependencies now track a development branch. drupal/audit_trail moves from ^1.0 to 1.x-dev, and drupal/domain_extras from ^3.0.4 || ^4.0 to 3.x-dev || 4.x-dev, because the renames this follows are in no released tag: audit_trail's getVerifier() is unreleased, and domain_extras' executeInDomain() landed after 3.1.0-alpha1 was cut. The two CI lanes could not otherwise be satisfied at once, since domain_extras 3.0.5 has only inDomain() and 4.x has only executeInDomain().

AI-Generated: Yes (Claude Code was used to measure the naming against a corpus built from Drupal core, to decide each rename, and to write the patch. I reviewed the decisions, and the full test suite runs in CI.)