Release the order when its checkout payment expires

Merge request for #3611874.

OrderLockSubscriber adds kessai.expired to its unlock set (alongside failed and cancelled); the example workflow adopts the payment step's payment_timeout and the dedicated expired outcome. Full E2E green locally.

Depends on kessai #3611872 and orchestra #3611873; CI here goes green once kessai lands in 1.x-dev.