feat(agents-api): support public self-hosted cancellation

[SaladDay]

Public self-hosted clients can submit cancellation-only event batches through the existing events endpoint. Previously these requests entered message-only reservation validation and returned 400. The Worker now reuses existing locked cancellation admission after configuration and execution-ownership checks, preserving idle receipts and the original target on retries.

Pending pre-Turn input still rejects new cancellation with the existing 409; mixed events, steering and functions remain separate gaps. HTTP 204 acknowledges durable admission and does not promise native completion or process exit. No Store, schema, daemon/native protocol, dependency or product behavior changes.

Validation on head a43c516: OpenAPI generation, isolated build, focused PostgreSQL/race/official-SDK checks, full make check (379.0 s), and the standalone official suite passed. The controlled regression fails on the original production path (400 versus 204) and passes with this change; it is enrolled in recurring CI.

Real MiniMax acceptance passed for cancellation followed by cold continuation, all three existing self-hosted text modes, and none initial/retry/history/API-restart/key-rotation regression: ten accepted Turns. Public cancellation returned in about 10 ms; the separate process-exit/stopped-heartbeat observation completed about 31.3 seconds after the request. SDK/raw cancellation streams matched all 177 event payloads, retained output remained queryable, and replaying the old cancel did not affect the later active Turn.

The first empty-create and ordinary-initial runs failed with native empty function arguments (10 and 16 parse errors). A single unchanged retry of only those two modes passed; both failed runs remain recorded under existing NATIVE-ARGS-001. This PR does not resolve that reliability issue or establish complete final cancellation Usage, pre-Start Outcome or a general process-stop bound. Existing three text workflows retain their assertions while sharing extracted test setup.

Owned test services/containers/volume/network were cleaned; shared execution storage was preserved. Fresh independent built-in blind review of all 16 files found no actionable in-scope issues; its report records static-validation limits. All applicable PR CI passed, including the new fixed-client cancellation fixture; product path-filter skips are covered by the full remote make check.

Task: ENV-PUBLIC-CANCEL-001 under ATOM-007; parent protocol scope remains open. Detailed requirements and exact source/verification evidence: ~/.parsar/remediation/20260915/environment-public-cancel on zju_a100_2.