runs: add non-destructive flag + operator Cancel button

Non-destructive pre-declares "don't touch the disks" on Start: the
Storage stage skips wipe-probe, badblocks -w, and write-mode fio,
and reports a read-only summary. Runs a new non_destructive column;
threaded through Claim → agent tests.Deps → Storage stage.

Cancel halts an in-flight run. The orchestrator transitions to a
new StateCancelled via TriggerOperatorCancelled (valid from any
active state); the agent's next heartbeat returns cmd=cancel_stage,
which fires a stored CancelFunc on the per-stage context. Stage
subprocesses spawned with exec.CommandContext die with the context,
the agent posts a cancelled outcome, then powers the host off.

Destructive stages mid-run may leave the host in an intermediate
state — the UI confirm dialog warns the operator; recovery is
manual for now.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

agent/client.go

@@ -112,11 +112,12 @@ type SensorSample struct {
 }
 
 type ClaimResponse struct {
-	OK            bool                    `json:"ok"`
-	RunID         int64                   `json:"run_id"`
-	Stages        []string                `json:"stages"`
-	ExpectedDisks []ClaimExpectedDiskSpec `json:"expected_disks"`
-	IperfPort     int                     `json:"iperf_port"`
+	OK             bool                    `json:"ok"`
+	RunID          int64                   `json:"run_id"`
+	Stages         []string                `json:"stages"`
+	ExpectedDisks  []ClaimExpectedDiskSpec `json:"expected_disks"`
+	IperfPort      int                     `json:"iperf_port"`
+	NonDestructive bool                    `json:"non_destructive"`
 }
 
 type ClaimExpectedDiskSpec struct {