Offer the dead-end, unrecoverable-failure and retry-cutoff policies on the settings form

Three site-wide settings decide what the engine does when a branch fails or dead-ends, and none of them is reachable from the Orchestra settings page, which offers the other eight.

• on_dead_end: raise an incident on a branch that took none of its outgoing flows, or complete it quietly.
• on_unrecoverable_failure: raise an incident and leave the run going, or fail the whole run.
• max_advance_attempts: how many failed advances a token gets before it is dead-lettered.

All three ship in config/install/orchestra.settings.yml, are typed and constrained in the config schema, and are read by IncidentStore. The only way to change one is to edit configuration by hand or write an update hook. docs/troubleshooting.md sends a site builder to on_dead_end: complete as the site-wide escape hatch, and docs/incidents.md documents all three as raw YAML, which is the whole audience for a setting nobody can reach from a page.

Proposed resolution. Add the three to SettingsForm, in the wording the schema and the documentation already use, with the same validation the numeric settings on that form get, and a functional test that saves each of them and reads the stored configuration back.

Found by the whole-tree audit of 1.x at 7c9f1b2a.

AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the code and tests on the merge request. I reviewed and ran the work myself before posting it.)