Issue #3611961: Let a webform step define labeled escape outcomes instead of a hardcoded Cancel

The webform step offered one hardcoded Cancel escape (signalOutcomes() = [cancelled], one CANCEL_KEY link). Now the workflow author defines the escape outcomes on the step, each with a label, reusing the shared OutcomeConfig value|label form: signalOutcomes() returns them, the interaction passes each label + signal URL, and the handler renders one button per outcome (a SIGNALS_KEY list). Submit stays the forward path; no outcomes = Submit-only. Unit-tested.