Draft: clarify run-scoped cancellation

[PhilosophiMoonbeam]

Summary

• Keep POST /executions/:id/cancel single-execution compatible.
• Add warning metadata when that narrow cancel leaves other non-terminal executions in the same run.
• Add af execution cancel-run <run_id> for the existing bottom-up cancel-tree run cancel path.

Why

• Single-execution cancel updates only the requested execution and publishes one cancel event: control-plane/internal/handlers/execute_cancel.go:79, control-plane/internal/handlers/execute_cancel.go:124.
• Worker cancellation is keyed by the exact execution id: sdk/python/agentfield/cancel.py:65.
• The existing run-level endpoint already documents why tree cancel is needed: control-plane/internal/handlers/execute_cancel_tree.go:22.
• The UI already uses run-level cancel for this reason: control-plane/web/client/src/pages/RunDetailPage.tsx:1271.

Compatibility

• No semantic change to the existing execution cancel endpoint.
• New JSON fields are additive: scope, run_id, remaining_active_in_run, suggested_endpoint, warning.
• New CLI command is additive; existing af execution cancel <execution_id> remains unchanged.

Tested

• go test ./internal/handlers -run 'TestCancelExecutionHandler|TestCancelWorkflowTreeHandler'
• go test ./internal/cli -run 'TestRunExecutionActionSuccessAndErrors|TestCancelRunCommandUsesCancelTree|TestUtilityAndExecutionCommandCoverage|TestResumeExecutionCommand|TestRestartExecutionCommandPostsRestartBody|TestPrintExecutionActionHumanOutput'
• go test ./internal/handlers ./internal/cli

Not run: web client tests; control-plane/web/client/node_modules is not installed locally.

[CLAassistant]

All committers have signed the CLA.