Issue #3622824: Split the action task on its base, and let ECA start a workflow with variables

Two follow-ups from the attach task, each independent of the other.

1. ActionTaskBase holds everything an action step does apart from deciding what to act on. The action task resolves an entity a process variable names and needs nothing but the engine; orchestra_content_action ships the content action task, which resolves the run's own attachment. The target setting goes with them, and with it the nullable attachment manager the action task used to carry and the form that offered a target it could not resolve.

2. The ECA start action can seed process variables, one per line as name: value, values token-replaced. That is all it takes to start a content-bound run: a model names the content as subject_type and subject_id, and the workflow's own attach step binds it. Start-for-entity had nothing left of its own and goes. The shipped content-review example binds its own content at its first step, so starting it takes two variables and no callable.

A name the engine keeps for itself is refused: the engine hides those variables from everything a workflow can read, so seeding one wrote a value nothing could route on, and nothing said why. The form refuses one, and a model arriving as configuration has it dropped and logged.

The pair-line format is read in one place, PairLines, which the subprocess task's variable maps had their own copy of.

Two checks come with the audit: the translation gate now reports an allow-list entry for a string no file writes any more, which is what the deletion left behind, and the documented-surface test asks that no page still offers the retired action.