[backportbot-libresign]

Backport of #9234 for LibreSign 15 (stable35).

Stable35 adaptation

The automatic backport's seven commits were incomplete: stable35 has the frozen signature_rejection policy (cancel_workflow) rather than SignatureRejectionBehavior, and lacks the newer SignRequest::isObserver() API. They were replaced by three focused commits signed with DCO and verified cryptographically.

• Resolve file status consistently after signing or rejection, preserving identification-document uploader placeholders.
• When the frozen policy continues after rejection, finish as SIGNED only if someone signed and every other signer either signed or rejected.
• Preserve cancel-on-rejection and transaction rollback, including restoration of document/envelope state and status caches.
• Add unit tests for resolution and rollback and a stable35 Behat regression scenario.

Self-contained test compatibility

A fourth signed commit adds the exact four updated Behat support files from #9324: nextcloud-behat v1.6.4, its lockfile, the activity-preference step and semantic JSON policy assertions. This PR can validate independently against stable35. If #9324 merges first, these overlapping changes become part of the base.

Validation

• Isolated focused PHPUnit: 43 tests, 126 assertions passed (PHP 8.3).
• PHP syntax, PHP-CS-Fixer, Composer manifest and git diff --check: passed.
• All 21 updated jq expressions passed synthetic JSON checks.
• Full stable35 CI on cb697c43a7fc finished: 57 successful checks, 7 skipped, 0 failures. All four PHPUnit and four Behat workflow matrices passed. SQLite/PHP 8.5 ran 202 Behat scenarios (202 passed), 3,278 steps (3,278 passed), including the new rejection-after-signature regression.

Merge-readiness checklist

• Stable35-specific code and test adaptation
• DCO-signed incremental commits
• Focused unit, lint and jq regression checks
• Full green stable35 CI (57 successful, 7 skipped)
• Independent human code review, then human-controlled merge

Integration order

Review and merge #9324 first, then recheck this PR before merging. The four shared Behat support files are byte-identical between #9324 and #9331. A Git merge-tree simulation reports no conflict. No part of #9305 (all-signers-rejected behavior) is included in this backport.