Name methods the way core does, rename ReadScope to ReadAccess, and follow the same renames in kessai, audit_trail and domain_extras

Closes the finding #3618935 measured and deliberately left open: method names that carry no verb.

What moved. 341 of orchestra's own method names began with no verb; after this, 24 do, and every one of those is a deliberate keep listed below. Nothing was swept: each name was judged against what the method does, because prefixing get blindly states the opposite of the truth.

• currentVersion() creates the version when none matches the workflow's current shape, so it is ensureCurrentVersion(). Its neighbour publishedVersion(), whose docblock says it creates nothing, is getPublishedVersion().
• activeByTokens() loads, so it is loadActiveByTokens(), beside the loadActiveByToken() it batches.
• incidentCancel(), incidentRetry(), instanceMigrate() return a RedirectResponse and perform the thing, so they are cancelIncident(), retryIncident(), migrateInstance().
• actionAccess() returns an AccessResultInterface, so it is checkActionAccess(), the shape core's access handlers use.

Where one name meant several things it was split, not swept. forInstance() was the pending actions of an account, the submissions bound to an instance, and the payment pinned to one. It is now getActionsForInstance(), loadForInstance() and findForInstance(), renamed per class with every call site checked by hand.

Kept. The domain's own verbs (fire, resume, claim, park, drain, sweep); the third-person predicates core also uses (applies, belongs, guards); the contract methods of core and of the modules orchestra implements; the OOP hook methods named after their hook; and the static factories in core's AccessResult::allowed() shape, which is what Recipient::forAccount(), CapabilityOutcome::messages() and nothing() are.

Longer names pushed comments past 80 columns and a few array declarations past 120, so those comments are rewrapped and those declarations split. phpcs is back to its baseline (0 errors, and the single pre-existing DrupalPractice warning), phpstan level 3 is clean, and cspell reports exactly what it reports on 1.x.

Route callbacks, #ajax string callbacks and one [$this, 'method'] entity builder are renamed with their declarations; the last of those cannot be seen by a pattern that anchors on a parenthesis and was done by hand.

---

The same rename upstream. kessai and audit_trail put a verb in front of the same kinds of method, so the bridges follow: PaymentHandoffController::handoffUrl() is getHandoffUrl(), the storage-schema seam indexes() is getIndexes(), and audit_trail's test helper verifier() is getVerifier().

The seam one failed silently: PaymentStorageSchema still overrode indexes(), which the parent no longer calls, so the bridge's orchestra_payment__token_state index was never created and every lookup from the pin scanned the whole payment table. Only the index test saw it.

orchestra tracked audit_trail at ^1.0, which resolves to 1.0.0-alpha6 and still carries the old name. It now tracks 1.x-dev the way kessai already did: both APIs are still settling before 1.0, and following a released alpha means writing the bridge against a version the dependency has already moved past. CI installs audit_trail dev-1.x and kessai dev-1.x, so the renames are exercised there.

---

Config keys change. ReadScope becomes ReadAccess, and the stored keys read_scope and instance_read_scope become read_access and instance_read_access. There are no update hooks before 1.0, so an existing site's saved settings, workflow overrides and tenant overrides need migrating or the module reinstalling.

Two dependencies now track a development branch. drupal/audit_trail moves from ^1.0 to 1.x-dev and drupal/domain_extras from ^3.0.4 || ^4.0 to 3.x-dev || 4.x-dev: the renames followed here are in no released tag, and the two lanes cannot otherwise be satisfied at once, since domain_extras 3.0.5 has only inDomain() while 4.x has only executeInDomain().