Issue #3612188: Make booking cancellation one order-driven path so a cancelled order is cancelled (not emptied) and its workflow instance is terminated

Fixes booking cancellation (full report in the issue).

• New order-cancellation bridge terminates an order running workflow instance when the order enters the cancelled state, from any surface (operator, cart, expiry). Covers the case a booking-event reconcile misses (an order with no line to transition), and stands down when the workflow itself drives the cancel so it never self-terminates mid-step.
• The example booking workflow abandon path cancels the order (yoyaku_cancel_order) instead of emptying it, so a cancelled booking is cancelled, not reused.
• Operator cancellation requires a dedicated "cancel booking" permission on top of managing the order; the customer signed-link path is unchanged.
• Clearer delete-guard message for a cancelled-but-running order, and the bulk form surfaces the guard reason.

Kernel tests: external cancel terminates an orphaned instance, workflow-driven cancel does not self-terminate, cancel needs the capability, foreign-tenant append rejected.