Fix 1.0.0-alpha8 delta-audit findings: concurrency recovery races and webform branch-scoping

Fixes the 1.0.0-alpha8 delta-audit findings (see issue [#3608117] for the full list).

Concurrency and recovery (WorkflowEngine, TimeoutSweep, WorkflowVersionManager): the common fix is to replace load-then-save inside a transaction with the conditional raw UPDATE pattern the code already uses for token claims, so a concurrent commit is never clobbered under REPEATABLE READ. Terminal instance flips (complete/cancel/fail) are now guarded on WHERE status = running; the dead-letter completion window is closed by treating a STATUS_ERROR token as blocking; the reconcile batch excludes incident-halted instances and is ordered; a new cron leg recovers stranded timeout joins; TimeoutSweep resolves the pinned definition and clears an unresolvable token's deadline.

Webform (handler, interaction, element): resume now targets the exact branch-scoped token when still parked (falling back to node resolution only on a genuine loop re-entry); the collect step reopens the branch's own submission; the workflow start is deferred to postSave so a failed save cannot orphan a run; an expired binding link surfaces a message instead of a silent success; the binding capability token is redacted from stored submission data after the submit cycle.

Testing: the orchestra kernel suite passes locally (core engine plus interaction_webform); Functional and FunctionalJavascript run in CI.