[orchestra:node-label] is empty on an unpinned run, and the user audiences notify blocked accounts

Two readers that answer differently from the rest of the module.

[orchestra:node-label] is empty when the run pins no version. The token resolves the node only through the instance's pinned definition version and returns nothing when there is none, so a run started with versioning off, or started before versioning was switched on, renders the token as empty. [orchestra:node] beside it resolves, because it reads the token's node id rather than the definition, and every other reader in the module falls back to the live workflow through DefinitionResolver. Reachable from any notification body or email template that uses the token, and the documentation offers it unconditionally.

The user audiences notify blocked accounts they will not offer the step to. The users and users_variable audiences load their accounts without filtering on status when they resolve recipients, while the same plugins drop a blocked account from the candidates, and the role audiences filter on status on both sides. So a blocked account is not a candidate for the step but is still emailed about it: someone is told to do work they cannot see or take. The users audience's own configuration form already refuses a name with no active account, so the live-membership read is the only place the rule was dropped.

What changes:

• The token hook resolves the node through DefinitionResolver, which reads the pinned version when there is one and the live workflow when there is not. TokenOutcomes, which carried its own copy of that pinned-else-live branch, reads the resolver too.
• Both user audiences drop blocked accounts from recipients as well as candidates, through one shared filter on their base class, which settles the disagreement the way the role audiences already answered it. The audience reference states the rule.

Kernel coverage for each: the node and node-label tokens both resolve on an instance that pins no version; a blocked named user is neither offered the task nor listed among its recipients, while the active user beside them is both.

AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the code and tests on the merge request. I reviewed and ran the work myself before posting it.)