Issue #3621216: Declare the current-step column's cacheability, and invalidate the tags at every guarded write

Two halves, either of which alone is inert.

The column. CurrentStep renders a run's parked tokens resolved to node labels, none of which is in the view's result, and it declared no cacheability at all. A field handler reaches a display's cache metadata only by implementing CacheableDependencyInterface, which FieldPluginBase does not, so the column now implements it and declares the orchestra_token, orchestra_workflow_version and orchestra_workflow list tags, no contexts, and a permanent max-age.

The writes. Six guarded UPDATE statements did not call RawUpdateTrait::refreshAfterRawUpdate(): three in SubprocessCoordinator (which now uses the trait), two in TimeoutSweeper, one in WorkflowExecutor. The two writes inside relaunchDueSubprocess()'s transaction share one refresh after the commit, since they write the same row and a rolled back transaction should throw away no render that is still true. claimDueDeadline()'s ternary became a guard so the refresh has somewhere to go, and resumeParent()'s refresh sits before its loadUnchanged() so the reload reads the claimed row rather than the storage's pre-claim copy.

Tests. Three, each failing against the unfixed code:

• MyWorkflowInstancesViewTest::testCurrentStepColumnDeclaresItsCacheability — the handler declares the three list tag sets and the display takes them. Before: Call to undefined method CurrentStep::getCacheTags().
• SubprocessTest::testArmingTheRelaunchExpiresTheTokenTag — arming a re-launch invalidates the token list tag. Before: the checksum does not move.
• RuntimeEntityCachingTest::testEveryGuardedRowUpdateRefreshesTheCaches — every method issuing a guarded update of a runtime table also calls the refresh. Before: it names the six.

A behavioural test per raw write would be vacuous at five of the six: an entity save follows each of them closely enough to invalidate the same list tag anyway, so the assertion would pass against the unfixed code. Arming a re-launch is the exception, and it is the one tested behaviourally; the rule the other five break is the trait's own documented one, which is what the source scan pins.

SubprocessTest's two existing re-launch cases duplicated the failing child workflow verbatim; that block is now a private helper the three cases share.