Add workflow inspection, cancellation, suspension, and deletion

[taras]

Story

As a workflow user, I want to inspect and control retained runs without advancing them, so execution ownership and recovery state remain explicit.

Contract

Add the local lifecycle surface around the start/resume slice:

xmd workflow status <run-id>
xmd workflow list
xmd workflow history <run-id>
xmd workflow cancel <run-id>
xmd workflow delete <run-id>

Status, list, and history are read-only. A run has at most one live executor. Running, suspended, interrupted, completed, failed, and cancelled remain distinguishable. Cancellation terminates live resources but retains the run. Deletion removes retained local state explicitly and never attempts to undo external effects.

Suspension releases the executor after recording the durable reason and any request for input. Resumption is explicit in this slice; host scheduling belongs to #300.

Acceptance

• Read-only inspection never advances replay or attaches Workspace, Agent, process, or external providers.
• A second executor cannot acquire a run already owned by a live executor.
• Stale ownership is diagnosed and recoverable without allowing concurrent mutation.
• Suspension and interruption remain resumable; uncaught failure and explicit cancellation are terminal for that run.
• Cancellation tears down scope-owned resources before publishing terminal status.
• History exposes filtered event identity, source, result/error, and the logical Workspace version after each committed event.
• Deletion requires an explicit run ID, reports what is removed, and does not claim to rewind external systems.
• Every terminal status retains its filtered journal and Workspace until deletion.

Dependencies

• Add the xmd workflow start/resume filesystem vertical slice #366 supplies foreground start/resume and the implicit Workspace.
• Store WorkflowRuns and filtered journals in SQLite #291 supplies durable run lookup and metadata.
• PR 📝 Specify retained workflow Workspaces #358 supplies the retained Workspace lifecycle contract.
• End goal: Document adversarial implementation workflow WIP #181.