Issue #3606290: Add orchestra_interaction for external-party interactive waits

Adds orchestra_interaction, the external-party counterpart of orchestra_inbox (see #3606290).

A wait node gains a Customer interaction feature: pick what an external party (a customer, applicant, respondent) should see while the step is parked, and a public dispatcher addressed by instance id plus a capability-token HMAC routes the visitor to it, resuming the workflow on their response. Each step returns to the dispatcher so a multi-step flow chains with no landing screens; a signal route resumes the step with a visitor-initiated outcome the interaction allows (cancel, back).

What is included:

• orchestra_interaction: the interaction NodeFeature (a plugin chooser with inline settings on wait nodes), the Interaction plugin type (manager, base, attribute), the message and redirect plugins, the dispatcher controller, the per-instance capability token, the URL builder, and the parked-node resolver.
• A small AdvanceQueueDrainer core helper, so a signalled queued instance advances in the same request instead of waiting for cron (no engine-class change).
• orchestra_interaction_webform: a generic Webform interaction plus a resume-on-submit Webform handler, so any workflow can collect input on a Webform during a wait (intake, approval response, survey, RFQ reply).

Symmetry with orchestra_inbox: operator side is a work item claimed from the inbox (pull) via assignment plugins; external-party side is a capability-token link to the parked instance (push) via interaction plugins. Domain plugins live in the consuming project.

Kernel tests cover the resolver read path and the capability token.