runs: add non-destructive flag + operator Cancel button

Non-destructive pre-declares "don't touch the disks" on Start: the
Storage stage skips wipe-probe, badblocks -w, and write-mode fio,
and reports a read-only summary. Runs a new non_destructive column;
threaded through Claim → agent tests.Deps → Storage stage.

Cancel halts an in-flight run. The orchestrator transitions to a
new StateCancelled via TriggerOperatorCancelled (valid from any
active state); the agent's next heartbeat returns cmd=cancel_stage,
which fires a stored CancelFunc on the per-stage context. Stage
subprocesses spawned with exec.CommandContext die with the context,
the agent posts a cancelled outcome, then powers the host off.

Destructive stages mid-run may leave the host in an intermediate
state — the UI confirm dialog warns the operator; recovery is
manual for now.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/web/templates/host_detail.templ

@@ -89,7 +89,11 @@ templ HostDetail(d HostDetailData) {
 				<h2>Actions</h2>
 				<div class="detail-actions-row">
 					if canStart(d.Tile) {
-						<form method="post" action={ templ.SafeURL(fmt.Sprintf("/hosts/%d/start", d.Tile.Host.ID)) } class="inline">
+						<form method="post" action={ templ.SafeURL(fmt.Sprintf("/hosts/%d/start", d.Tile.Host.ID)) } class="inline detail-start-form">
+							<label class="detail-nd-toggle">
+								<input type="checkbox" name="non_destructive" value="1"/>
+								Non-destructive (skip wipe-probe + disk writes)
+							</label>
 							<button type="submit">Start vetting</button>
 						</form>
 					} else if canStartIfOnline(d.Tile.Latest) {
@@ -97,6 +101,11 @@ templ HostDetail(d HostDetailData) {
 					} else {
 						<button type="button" disabled>Run in flight</button>
 					}
+					if canCancel(d.Tile.Latest) {
+						<form method="post" action={ templ.SafeURL(fmt.Sprintf("/hosts/%d/cancel", d.Tile.Host.ID)) } class="inline" onsubmit="return confirm('Cancel run? Destructive stages may leave the host in an intermediate state requiring manual cleanup.');">
+							<button type="submit" class="danger">Cancel run</button>
+						</form>
+					}
 					if canOverrideWipe(d.Tile.Latest) {
 						<form method="post" action={ templ.SafeURL(fmt.Sprintf("/hosts/%d/override-wipe", d.Tile.Host.ID)) } class="inline">
 							<button type="submit" class="danger">Override wipe-probe</button>