Issue #3608606: Confine stale-handle resume to its own step, plus list, translation, docs and hardening follow-ups

Frank Mablyrequested to merge
issue/orchestra-3608606:3608606-confine-stale-handle-resume into 1.x

Fixes the delta-audit findings for [#3608606].

  • H1/M1: liveBranchToken() confines a consumed-handle resume to the same node (genuine loop re-entry) and never takes the sibling-unsafe node fallback; the return link keeps chain-scoped-any-node via a separate method. storeSubmission() is gated behind authorize() on the resolved token so a refused resume writes nothing.
  • M2: one labelled status map shared by the instances list and its filter.
  • M3: French translations for the new orchestra_ui strings.
  • M4: docs updated (webform re-edit gotcha, version column, admin-only tenant filter, 1-hour defer backoff).
  • L1: workflow filter options scoped to the operator tenant for non-admins.
  • L2: GET filter form strips core form_build_id/form_id/op elements.
  • L3: definition-unresolvable defer moved inside the per-token try block; node-missing defer path now tested.

All six touched kernel suites pass locally.

Merge request reports