Issue #3618957: Track Kessai's renamed payment API: plugin.manager.kessai_payment_gateway, deleteStoredCard() and STATE_CANCELED

Kessai renames part of its public API in #3618948. Three lines here say the old names, plus the constraint that decides which Kessai those lines are compiled against.

what	where
kessai.gateway_manager -> plugin.manager.kessai_payment_gateway	PaymentInteraction.php
forgetCard() -> deleteStoredCard()	StoredCardCleanupSubscriber.php
STATE_CANCELLED -> STATE_CANCELED	SettleTaskTest.php

The service id is the one that breaks the site rather than a test: it is resolved from the container by name, so an Orchestra asking for the old id against a renamed Kessai fails to compile the container and every page 500s.

The constraint change

require-dev moves from ^1.0.0-alpha4@alpha to 1.x-dev@dev. An alpha tag cannot carry a rename that has not been released, and orchestra_payment follows Kessai's API as it settles before 1.0. Yoyaku already tracks 1.x-dev for the same reason.

The per-package @dev stability flag is used rather than a global minimum-stability: dev: Yoyaku sets one globally, Orchestra sets none, and only this one dependency needs dev. The previous constraint used the same idiom (@alpha).

Why this is a Draft

CI cannot pass until #3618948 merges into Kessai's 1.x, because 1.x-dev still carries the old names until then. The red pipeline here is the ordering working as intended, not a defect in this branch. Undraft once Kessai !48 (merged) has landed.

Verified locally: phpcs Drupal,DrupalPractice over orchestra_payment exit 0, and composer validate passes.