Give the return target and each doorway's task argument one name

Problem/Motivation

Three request-argument names are a contract between the code that writes them and the code that reads them back, and each is written out independently in several places rather than named once.

The return target. OrchestraReturn::ARG is the constant the return-to-list service resolves. Drupal\orchestra_interaction\Form\CommentForm::RETURN_ARG declares a second public constant holding the same value, and UserTaskForm and UserOperationForm each hard-code the string twice, once to write the hidden field and once to read it back.

The identity doorway's task token. The orchestra_interaction_task routes carry the parked token as a query argument, not a path parameter, so nothing in the routing file owns the name. It is a literal in seven places in that module: AssignmentGateway twice, InteractionTaskActionHandler twice, InteractionTaskController three times.

The content task's token. The same shape again, on the separate orchestra_content.task route, which also takes its token from the query: a literal in four places, in EntityInteraction, EntityTaskController and OrchestraContentFormHooks.

Nothing is broken today, because the values agree. What is missing is the thing that keeps them agreeing. Renaming any of them leaves a writer emitting one name and a reader looking for another, and both drift silently: completing a task from a list would land the operator on the inbox rather than the list they came from, and the task screen would answer that the step is no longer available, with nothing in the log to say why.

This is the audit rule the project already applies elsewhere: a constant that exists so two ends agree is audited by its value, not by its symbol.

Proposed resolution

• Drop CommentForm::RETURN_ARG and read OrchestraReturn::ARG everywhere, including the four literals in the two completion forms.
• Give each doorway's query argument a constant on the class that owns the route it belongs to, and read it from every writer and reader in that module.

Route parameters spelled orchestra_token are deliberately untouched: those match a parameter the routing file declares, which is the routing file's to own.

Remaining tasks

Review the merge request.

Release notes snippet

No behaviour change. The request-argument names shared between a writer and a reader are each declared once and referenced, rather than repeated as literals.

AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the change and its test on the merge request. I reviewed the work and ran the affected tests myself before posting it.)