Issue #3607720: Per-instance operations (cancel, migrate to current, delete) on the process instance list

Adds per-instance operations to the process instance list, complementing the per-workflow bulk migrate already added in #3604588.

• New WorkflowVersionManagerInterface::migrateInstance() (per-instance counterpart of migrate(), sharing the validate/apply logic).
• Process instance list gains an Operations column: Cancel, Migrate to current (running instances only, and only when behind the published version), and Delete. Plus bulk Cancel selected and Migrate selected to current.
• Require cancel before delete: an InstanceDeleteGuard delete-access rule denies deleting a running instance; the list hides/rejects delete while running; the confirm form skips any running instance that slips through. Internal cascades and purges delete programmatically and are unaffected.

Tests: kernel coverage for migrateInstance() (migrate + remap, no-op when already current, rejects unmapped node); functional coverage for the cancel-before-delete rule and bulk cancel.