fix(workflows): terminalize pending cancellation projection

[andrei-hasna]

Scope

Rebase and preserve the existing OPE2-00286 workflow lifecycle successor repair. This draft does not merge, release, install, deploy, or mutate production workflow or goal state.

Exact candidate

• Base: c3c84a8e57371227cabacff1179238560287c265
• Head: 3d82893e1fc90b43166f8fc311652bdddfb7c37f
• Head tree: 3d9253adf45f52e00d748bcab67b86826506dbc7
• GitHub merge commit: 9fc717c0af08f826d99038e44ca5466dbdbd62c2
• Merge parents: current main c3c84a8e57371227cabacff1179238560287c265, head 3d82893e1fc90b43166f8fc311652bdddfb7c37f
• Merge tree: 3d9253adf45f52e00d748bcab67b86826506dbc7

git range-diff maps the three preserved commits one-to-one across the rebase. The diff remains limited to:

• codex-rs/ext/workflows/src/activation.rs
• codex-rs/ext/workflows/src/manager_tool.rs
• codex-rs/state/src/runtime/workflow_goal_plan_projections.rs

Regression contracts

• Structured, recoverable durable start failure without a partial orphan projection.
• Exactly one durable run and projection for repeated starts under one idempotency key.
• Pending-only cancellation terminalizes run, steps, and projected goal plan.
• Cleanup preserves the unrelated parent goal plan.
• Unbudgeted workflows create no plan or node token budgets.

Evidence

• Red control: Blacksmith run 31337393343, job 93305381727.
• Prior focused green control: Blacksmith run 31337791964, job 93306390672, 31 workflow-extension tests and 4 state-projection tests passed.
• Intermediate rebased-head focused run 31345003170 passed, then became stale when main advanced.
• Fresh current-head workflows: 31346117378, 31346118301, 31346118300, 31346118299, 31346118294, 31346118338, 31346118329, 31346118291, 31346118304.
• Fresh current-head focused Blacksmith run: 31346149853.
• Current-head result: all 10 expected runs completed successfully.
• Exact check-run population: 29 completed, 26 success, 3 intentional skips, 0 pending, 0 failing.
• Local lightweight checks: formatting, patch equivalence, whitespace, staged/range secret scanning, and commit provenance passed.
• Local Rust/Bazel build, test, Clippy, and compilation were not run by task policy.

Review state

• Self-review: passed with zero evidence-backed, currently reachable, in-scope P0/P1 lifecycle, integrity, compatibility, or required-gate defects.
• Required independent Fable review: pending.

This PR must remain draft and must not merge until the independent Fable review is recorded separately.