Close gaps: GLM-judge (anthropic registry) + run cancel + deep-link

#2 GLM judge (closes #114): registry NamedProvider gains a `format` field;
build_provider_registry builds an AnthropicProvider for format="anthropic".
GLM's coding/OpenAI endpoint is ToS-throttled for raw SDK, but its Anthropic
endpoint (api.z.ai/api/anthropic) accepts raw API calls (verified x-api-key
-> glm-4.7), so CLAWMATES_JUDGE_MODEL=glm:glm-4.7 routes the door governor /
topology judge through GLM with no runtime-routing. (Kimi-as-judge still needs
a Platform key — coding key is agent-only.)

#3 run-control: POST /api/topology-runs/{id}/cancel (workspace-scoped,
queued/running only); the worker honors it at the step boundary (checks
current_status in the checkpoint callback) and won't clobber a cancel with
`failed`. Frontend Run tab gains a Cancel button and clickable recent runs
that deep-link into a live/replayed stream (SSE replays from checkpoint).

cm-* tests (incl. new cancel test) + clippy + frontend lint/typecheck green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

crates/cm-api/tests/topology_jobs.rs

@@ -85,3 +85,30 @@ async fn stale_running_jobs_are_requeued_for_resume() {
     assert_eq!(st.status, "queued");
     assert!(topology_runs::claim_next_queued(&pool).await.unwrap().is_some());
 }
+
+#[tokio::test]
+async fn cancel_transitions_only_active_runs() {
+    let pool = cm_testkit::test_pool().await;
+    let ws = seed_workspace(&pool).await;
+
+    let id = Uuid::now_v7();
+    let graph = json!({"kind": "pipeline", "nodes": [{"id":"n1","role":"drafter"}], "edges": []});
+    topology_runs::enqueue_run(&pool, id, ws, "task", &graph)
+        .await
+        .unwrap();
+
+    // A queued run cancels; the worker sees the new status (no workspace scope).
+    assert!(topology_runs::cancel(&pool, id, ws).await.unwrap());
+    assert_eq!(
+        topology_runs::current_status(&pool, id).await.unwrap().as_deref(),
+        Some("cancelled")
+    );
+    assert_eq!(topology_runs::status(&pool, id, ws).await.unwrap().status, "cancelled");
+
+    // Already terminal → cannot cancel again; wrong workspace → no-op.
+    assert!(!topology_runs::cancel(&pool, id, ws).await.unwrap());
+    let other = seed_workspace(&pool).await;
+    let id2 = Uuid::now_v7();
+    topology_runs::enqueue_run(&pool, id2, ws, "t", &graph).await.unwrap();
+    assert!(!topology_runs::cancel(&pool, id2, other).await.unwrap());
+}