Label the audience, the engine state and the workflow a run belongs to, wherever a person reads them

The three places the audit at 7c9f1b2a found a machine name printed to somebody reading it for its meaning, while the human label was already resolved elsewhere in the same module.

The audience of a pooled task

WorkItemManager::getHolderLabel() fell back to the stored candidate tokens and printed them verbatim: Offered to: role:reviewer, user:12. Both surfaces that render it are ones an operator reads constantly, the task inbox and the Views Held by column, and the incident raised for a step nobody is left to take named the same tokens back at them.

A token is opaque outside the dimension that minted it, so it is asked the way getUnmatchedCandidates() already asks: every dimension is handed the whole set and answers for its own. AssignmentInterface::getCandidateLabels() is the question, with the base class answering nothing, so a custom audience keeps showing its token rather than a guess; the role dimension answers with the role label and the user dimension with the display name. A companion getCandidateLabelCacheTags() names what each of them read, so the inbox and the Views column expire when a role or an account is renamed, which writes nothing to the task.

The name of a run

ProcessInstance::label() built its name out of getDefinitionId(), so My Orchestra actions called a run leave_request #42 while the run own read page titled it Leave request. The workflow label is the name now, with the machine name as the fallback for a run whose workflow configuration is gone.

The administrative instance surfaces

The instance page summary printed the raw state, workflow and tenant. The state now goes through ProcessInstance::getStateLabels(), which five other surfaces already read it through; the workflow and the tenant are named Label (machine name), because an administrator recognises the first and filters, greps and Drushes by the second. The instances list Workflow and Tenant columns take the label alone, which is what the Views mirror of the same list already shows under the same heading.

Tests

• WorkItemPresentationTest::testPooledRowNamesItsAudience — a step offered to a role and an account reads Offered to: Reviewer, dana, and a token no dimension minted keeps its own text.
• WorkItemPresentationTest::testInboxDeclaresTheAudienceItNames — the render carries config:user.role.reviewer and the account tag, and not the role list tag.
• PendingActionsFinderTest::testMyActionsRowsPrintAnAuthoredLabelWhole — the Process cell now reads Bracket flow #1; it asserted bracket_flow #1 before.
• PendingActionsFinderTest::testTheRunKeepsItsMachineNameWhenItsWorkflowIsGone — the fallback.
• InstanceListDisplayTest::testWorkflowAndTenantColumnsNameTheirConfig.
• OrchestraUiTest::testDriveInstanceThroughUi — State: Running, and explicitly not State: running; it asserted the lower-case machine value before.
• DelegationVisibilityTest — four assertions moved from Offered to: role:reviewer to Offered to: Reviewer.

phpcs and phpstan (level 5) are clean on the module.