Issue #3605318: Attach multiple content entities to a process instance (keyed attachments)

A process instance can now have several content entities attached, each under a key (a role). The empty key is the primary subject and preserves the historical single-attachment behavior, so a one-entity workflow needs no key.

What changed

• AttachmentManager gains a keyed API: attach() / attachmentFor() / entityFor() take an optional key; attachmentsFor() / entitiesFor() return every binding keyed by its key; instancesFor() filters by key (or returns every run about an entity when no key is given). startFor() takes a key.
• The orchestra_attachment entity gains an attachment_key field, with one entity per (instance, key). Re-attaching under a bound key re-points it; a different key coexists.
• Every consumer takes an optional Attachment key (default = primary subject): the entity-edit task, the moderation task, the Action task attached target, and the ECA load/start actions. The shared AttachmentKeyConfigTrait carries the form element and reader; the Action task inlines it (it only optionally depends on Orchestra Content).

Backwards compatibility

The primary subject stores NULL (a string field prunes the empty string), matched with IS NULL. Existing rows therefore already read as the primary subject, and an installed site needs no backfill.

Tests

AttachmentTest adds keyed coexistence, per-key re-attach, and instancesFor() key-filter cases. All orchestra_content* and orchestra_action kernel tests, the EntityTaskFormTest functional test, phpcs and cspell pass locally.