feat: interrupt running agent via card button with confirm dialog

Add a ⛔ 中断 button to live streaming cards; Feishu's native confirm
dialog is the confirmation step, so no extra card round-trip is needed.

- builder.ts: render interrupt action (danger button + confirm) while the
  run is live; new `interrupted` flag renders a 已中断 footer instead of
  完成/失败 on the complete card.
- streaming-card.ts: finish(text, { interrupted }) threads the flag into
  the final patch; overflow cards suppress the button.
- runner.ts: RunRequest gains abortController, passed to the SDK query;
  abort surfaces as RunStatus "interrupted" (no error) in the catch.
- trigger.ts: activeRuns registry maps runId → AbortController; onCardAction
  resolves the interrupt button, authorizes agent.cancel, aborts the run.
  Interrupted runs persist as CANCELED (spec RunState.canceled, terminal →
  lock released per ADR-0002).
- authorizer.ts: agent.cancel now consults PermissionSettings.agentCancel
  (MANAGE_ONLY/DISABLED) — previously only agentTrigger was honored, but
  spec/PermissionGrant deliberately splits these knobs ("谁能触发" ≠
  "谁能取消"). Default role remains MANAGE (Capability.normalCancel).

Tests: runner abort unit test, trigger interrupt + denied integration
tests, three agent.cancel authorization tests (manage allowed, edit denied,
DISABLED policy denies even manage). 26 files / 175 tests pass.

hub/src/feishu/card/streaming-card.ts

@@ -56,6 +56,7 @@ export class StreamingAgentCard {
   private flushChain: Promise<void> = Promise.resolve();
   private flushScheduled = false;
   private lastPatchAt = 0;
+  private interrupted = false;
 
   private readonly runId: string;
   private readonly rt: FeishuRuntime;
@@ -102,9 +103,9 @@ export class StreamingAgentCard {
     recordToolUseEnd({ runId: this.runId, ...params });
     this.scheduleFlush();
   }
-
-  async finish(fallbackText: string): Promise<void> {
+  async finish(fallbackText: string, options: { readonly interrupted?: boolean } = {}): Promise<void> {
     await this.flushChain;
+    this.interrupted = options.interrupted === true;
     if (this.text.length > 0) {
       await this.flushCard("complete", this.text);
       return;
@@ -164,6 +165,7 @@ export class StreamingAgentCard {
       toolUseSteps,
       toolUseElapsedMs: this.toolUseElapsedMs,
       isError,
+      interrupted: this.interrupted,
       runId: this.runId,
     });
 
@@ -178,7 +180,8 @@ export class StreamingAgentCard {
           toolUseSteps: [],
           toolUseElapsedMs: undefined,
           isError,
-          runId: this.runId,
+          interrupted: this.interrupted,
+          runId: undefined,
         });
         this.currentMessageId = await sendCard(this.rt, this.chatId, overflowCard);
       }
@@ -193,7 +196,8 @@ export class StreamingAgentCard {
           toolUseSteps: [],
           toolUseElapsedMs: undefined,
           isError,
-          runId: this.runId,
+          interrupted: this.interrupted,
+          runId: undefined,
         });
         this.currentMessageId = await sendCard(this.rt, this.chatId, overflowCard);
       }