v1.2.8 — Guest-aware withdrawal URL on every surface

Completes the 1.2.7 guest fix. 1.2.7 made only the automatic order button route guests to the public form page; three other surfaces that build the withdrawal URL still produced the login-gated My Account URL for everyone — the [wwu_wb_button] / [wwu_wb_form] shortcodes, the eligible-orders list, and the My Account order-actions link (woocommerce_my_account_my_orders_actions).

On a real store this showed as two links on the order-received page: the automatic button (correct) and a second one in the theme-rendered "Actions" row that bounced guests to the login screen. With a stock theme (Twenty Twenty-Five) only the automatic button appears — so the duplicate was theme-dependent, not a manual shortcode.

What changed

• New Frontend\WithdrawalUrl — a single source of truth for the viewer-aware URL: logged-in → owner-verified My Account endpoint; guest → public form page + order ref + WooCommerce order key (the same pre-authenticated link the order email uses), so guests reach the form with no login.
• All four URL producers now delegate to it (WooMyAccount button + order-actions, both shortcodes, the orders list). The dead WooMyAccount::form_url() / guest_form_url() were removed.

No change to the logged-in flow, the public page, the evidence log or the REST API. PHP lint clean.

Full notes: docs/changelog/wwu-wb-CHANGELOG.md.