Runs one picked instance to a committed outcome (spec §3/§4).

Resolves the FSM module, loads the jsonb state into the FSM's struct, snapshots the signal inbox, calls step/2 under try. A raised exception routes to handle/2 (spec §4.2); if handle/2 itself raises, the instance fails. A worker crash (no return at all) is not handled here — it is the reaper's job (spec §4.3), the at-least-once safety floor.

Signal consumption is name-scoped (spec §5): on a progressing outcome the outcome transaction deletes exactly the inbox signals whose name matches the row's awaits (the name the step was parked on), and clears awaits. Signals for other names — and signals on a never-awaited instance — survive. The snapshot in ctx.signals is read-only; deletion happens in SQL, not by id.