fix: #3624692 Put the two always-recorded instance events on the audit trail settings form

The subscriber reads a missing key as enabled, so a box on the Audit trail settings form is the only way to drop an event. Two recorded actions were on no form, in no shipped configuration and in no schema: orchestra.instance / remote_child_orphaned, written by RemoteChildPoller when a child run on another site is given up on, and orchestra.instance / notice_undeliverable, written by DeliverNotice when a caller is never told about an event. Both were written on every site with nothing an administrator could do about it, while the documentation page listed them and said every event can be toggled.

They are now offered like the rest, on by default, in the form, the install config and the schema, and the module README table names them the way docs/audit.md already did. No update hook: the module is pre-beta, and a missing key already reads as enabled, so an installed site loses nothing by not having them.

The test is in AuditTrailChainInstallTest, beside the existing one that saves the form to keep its keys and the schema in lockstep. It saves the form with remote_child_orphaned unchecked and then asks the subscriber what it does with that event. Without the box the form writes no key, and the subscriber records it anyway.

Rebased on 1.x after !530 (merged) merged (clean, no overlap).

Audit rounds (5, closed on a clean round).

Round 1 swept every recorded action against the form rather than taking the issue's count on trust: recordInstance() is called with 7 distinct actions, auditTask() with 7, recordToken() with 3 and recordVariable() with 1 — and the form now offers exactly those, no more and no fewer. So the fix is complete, and nothing else is unswitchable.

Round 2 mutated it and found half the fix unguarded. Dropping remote_child_orphaned from the form turned the test red; dropping notice_undeliverable did not. That event was the one left checked as the control, and a checked event is recorded whether or not the form knows it, because a missing key reads as enabled. So one of the two events this issue is about had nothing holding it: remove it and the defect returns for that event with every test still green.

Both are now unchecked and asked about, and the control moves to started — an event that was never in question. Each of the three shapes fails it: either event dropped, or both.

Round 3 confirmed the other lockstep holds. Removing the two schema entries makes installing the module throw SchemaIncompleteException naming both keys, so shipped config and schema cannot drift. docs/audit.md and the README table now agree, and the page's claim that "every event can be toggled on the settings form" is true for the first time.

The completeness this restores had nothing pointing at it, so getChannels() now states the invariant: an action recorded anywhere and missing from that list is written on every site with no way to switch it off. That is what happened twice, and it is a doc line rather than a test on purpose — the only mechanical check would be a test that reads source files for recordInstance('…'), which tests nothing about behavior.