Issue #3605834: Move process instances to Structure, add a canonical link and a per-tenant access permission

Implements [#3605834].

Process instances are runtime data, not workflow configuration. This moves the instance UI to Structure > Orchestra > Instances (/admin/structure/orchestra/instances), renames the detail route to the entity-canonical convention entity.orchestra_instance.canonical (with the canonical link template declared via hook_entity_type_alter in orchestra_ui, so the entity stays UI-agnostic and toUrl() resolves through the route system, surviving an admin-path rename), and adds a dedicated access orchestra instances permission for the list, detail and drive operations (signal, fire timer, run), distinct from administer orchestra. A tenant access check confines a scoped operator to the current tenant on the id-bearing routes (mirroring the incident check), and the list is scoped to the current tenant for non-administrators.

Adds a unit test for the tenant access check; updates the functional tests to the new paths. Local: orchestra_ui functional (4) + kernel (4) + new unit (5) all pass.