Stop a running job at its runner's next heartbeat

Stop a running job at its runner's next heartbeat

A maintainer could cancel a queued run and nothing else: CancelRun only retired
waiting work, so a build that was clearly wrong or expensive held its runner
until its budget ran out, or until somebody killed the container by hand. The
queue cannot kill a process it does not own, but it can ask.

Canceling a running run now marks the queue row and leaves the lease alone,
because the runner still holds it and its partial attempt has to be acceptable.
The runner sees the request on the heartbeat it already sends while a step or an
image build runs, stops the container, writes one line to the log, and reports
what it did. RecordAttempt and Finish then keep the canceled status instead of
mapping the nonzero exit code to failed, so the partial log and step timings
survive and the run is not a red build.

A stop request whose runner dies first becomes canceled on the expiry sweep
rather than being leased again, and a rerun clears the request: it is a new
decision. The run page says who asked, distinguishes a run stopped while running
from one canceled in the queue, and shows the interrupted step as stopped rather
than failed.

Closes #162.