fix: #3610463 Do not fail a Worldline payment on a transient return status-fetch error; leave it pending for the webhook

Follows the audit before the first alpha. The Worldline return controller fetched the authoritative outcome from Worldline and called PaymentManager::fail() on any fetch failure, flipping the still-pending payment to failed.

That defeated the webhook backstop. The server-to-server webhook is the authoritative channel that settles a payment when the payer never returns, and the finalizer it shares only acts on a still-pending payment. Once the return had failed the payment, a later webhook carrying the real captured outcome found it no longer pending and left it failed, so a genuinely paid checkout was stranded as failed with the webhook unable to repair it.

Fix

• On a transient status-fetch error, log and leave the payment pending, so the webhook (or a back-office reconciliation) still settles it. Only an authoritative negative outcome, through the finalizer, fails a payment.
• When the client is momentarily unavailable but a checkout session exists, leave the payment pending rather than failing it.
• Still fail a payment that never obtained a hosted-checkout session, since there is nothing to reconcile.

Tests

Adds WorldlineReturnTest (kernel): a transient fetch failure leaves the payment pending (the regression), a missing checkout session fails it, and a forged return token is denied. The existing kessai and kessai_worldline kernel suites pass unchanged.