Cancel semantics for AgentRun and AgentWorkflowRun

Add cancellation support for AgentRun and AgentWorkflowRun.

## Design (per ADR 0006)

- Add `spec.cancel` field to AgentRun and AgentWorkflowRun
- Add `Cancelled` phase to AgentRunPhase
- Controller behavior on `spec.cancel: true`:
- **Running**: delete the Sandbox, set phase to `Cancelled`
- **Pending** (queued behind `maxConcurrentRuns`): no Sandbox exists; set phase to `Cancelled` immediately, preventing Sandbox creation
- Token and Secret cleanup is idempotent in both cases

## Hub side

- Hub cancel handler (`POST /hub/agent/runs/:name/cancel`): revokes the Hub API token, then sets `spec.cancel: true` on the CR
- The UI cancels runs (never deletes them)

## References

- ADR 0006: Hub addon pattern for agent resources
- Enhancement: [konveyor/enhancements#295](https://github.com/konveyor/enhancements/pull/295) — Hub integration section

Start by reading ADR 0006, then locate the AgentRun and AgentWorkflowRun resource definitions and their controllers. Trace the Hub cancel handler and the pending and running controller paths. Done means cancel requests revoke the Hub API token, set spec.cancel, produce the Cancelled phase, avoid creating pending Sandboxes, delete running Sandboxes, and clean up tokens and Secrets idempotently.

Written by the indexing model from the issue text.