KanBorg 1.2.28 — reliable update cancellation

Cancelling an update no longer leaves Autopilot stuck winding down when staged installer cleanup fails. Cancellation is durable; bounded cleanup retries end in a warning without blocking workflow restoration. The coordinator also reconciles stale wind-down state from cancelled, failed or completed updates before resume and during its normal checks.

An update cancelled while worker-readiness checks are pending cannot proceed to installation afterward. Existing workers are not stopped or duplicated by cancellation.

Validation: all 122 desktop tests and TypeScript checks passed, including cleanup failure, cancellation during readiness and stale wind-down recovery. The affected running 1.2.26 instance was recovered through its existing controller by repeating cancellation with a fresh request ID, then resuming Autopilot; the coordinator confirmed its workers remained active. This release includes the 1.2.27 phase-context and stable Developer ID signing changes. Signed, not notarized.