Issue #3607005: Fix the 1.0.0-alpha5 audit findings

Frank Mablyrequested to merge
issue/orchestra-3607005:3607005-fix-the-1.0.0-alpha5 into 1.x

Fixes #3607005. Consolidated audit follow-up (full detail in AUDIT.md).

High

  • Forbid deleting the default tenant (would brick the engine): access handler + list-builder + predelete guards.
  • Add interface-translation directives to 11 submodules so their bundled fr.po is imported.
  • Add a route-access functional test for the public HTTP API.

Medium

  • API consumer with an empty/dangling tenant binding fails closed (no default fallback).
  • Engine spawn() takes the token lock and re-checks committed status before forking.
  • CM form no longer offers a second start node; validates a single start.
  • Views attach the tenant cache context independently of the filter (cross-tenant render-cache leak for custom views).
  • Lineage resolution batch-loads the parent chain.
  • Audit trail: opt-in strict mode + variable name/scope routed to the permanent bucket.
  • Example workflows install schema-clean without modeler_api.
  • Interaction catch-up keeps a branch-scoped link branch-scoped.

Low

  • RedirectInteraction rejects non-http(s) and uses a branch-scoped return token; remove the stray pre-1.0 update hook; content-task completion re-checks access; document the forced moderation transition and full-privilege action execution; ECA token-bag snapshot/restore; Variable::setValue throws on json_encode failure + deterministic internal reads; split the API permission into read/write, cap variable size, wrap API reads, fix composer suggest/description.

Adds tests across the changed areas. Kernel + unit suites pass locally (217 tests); functional tests run under CI.

Merge request reports