runs: add non-destructive flag + operator Cancel button

Non-destructive pre-declares "don't touch the disks" on Start: the
Storage stage skips wipe-probe, badblocks -w, and write-mode fio,
and reports a read-only summary. Runs a new non_destructive column;
threaded through Claim → agent tests.Deps → Storage stage.

Cancel halts an in-flight run. The orchestrator transitions to a
new StateCancelled via TriggerOperatorCancelled (valid from any
active state); the agent's next heartbeat returns cmd=cancel_stage,
which fires a stored CancelFunc on the per-stage context. Stage
subprocesses spawned with exec.CommandContext die with the context,
the agent posts a cancelled outcome, then powers the host off.

Destructive stages mid-run may leave the host in an intermediate
state — the UI confirm dialog warns the operator; recovery is
manual for now.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/model/model.go

@@ -38,8 +38,17 @@ const (
 	StateFailed         RunState = "Failed"
 	StateFailedHolding  RunState = "FailedHolding"
 	StateReleased       RunState = "Released"
+	StateCancelled      RunState = "Cancelled"
 )
 
+func (s RunState) IsTerminal() bool {
+	switch s {
+	case StateCompleted, StateFailed, StateFailedHolding, StateReleased, StateCancelled:
+		return true
+	}
+	return false
+}
+
 type Run struct {
 	ID                int64
 	HostID            int64
@@ -53,6 +62,7 @@ type Run struct {
 	ReportPath        string
 	HoldIP            string
 	OverrideFlagsJSON string
+	NonDestructive    bool
 }
 
 type StageState string