Issue #3609095: Add an orchestra_payment bridge to take a payment as a workflow step

Fixes [#3609095].

Adds an orchestra_payment submodule: a payment interaction node (on a wait node) driven by a pluggable PayableResolver (bundled variable resolver), a settlement bridge that resumes the pinned token on a Kessai payment outcome, orchestra_token/delete_token_on_end fields on the payment entity, and run-end stored-card cleanup. Ships an orchestra_payment_example submodule with a ready-to-run workflow and a kernel test (park -> settle -> resume as paid, plus failed/unpinned/resolver cases). Backed by the Kessai payment engine (added to composer require-dev).