As to the orphan deletion part of your question, it should be easy to implement a separate job that deletes orphans periodically.  If you do that then you can map the entities as they really are rather than forcing them into a mapping that might not make sense.  Orphan deletion seems counter intuitive to me in this situation.
As to the mapping of the association from cm_step to cm_rule_set, here's how I did it and it seems to work well on my sample program (note the column elements within the key):
Code:
    <class name="CmStep" table="CM_STEP">
        <composite-id>
            <key-property name="stepId" column="STEP_ID" />
            <key-property name="stepVersionId" column="STEP_VERSION_ID" />
        </composite-id>
        <many-to-one name="cmRuleSet" lazy="false">
            <column name="STEP_RULE_SET_ID" />
            <column name="STEP_RULE_SET_VERSION_ID" />
        </many-to-one>
    </class>
    <class name="CmRuleSet" table="CM_RULE_SET">
        <composite-id>
            <key-property name="ruleSetId" column="RULE_SET_ID" />
            <key-property name="ruleSetVersionId" column="RULE_SET_VERSION_ID" />
        </composite-id>
        <set name="cmSteps" inverse="true" lazy="false">
            <key>
                <column name="STEP_RULE_SET_ID"/>
                <column name="STEP_RULE_SET_VERSION_ID" />
            </key>
            <one-to-many class="CmStep" />
        </set>
    </class>
Hope this helps,