feat(ui): cancel a running command on Ctrl-C

[lavindeep]

A Ctrl-C while a model-invoked run_command child is still running now kills that child immediately, instead of waiting out its (default 600s) timeout. Branch 6 already cancelled the model stream; this threads the same per-turn cancel event down to the command (DESIGN §31.15).

What it does

• The per-turn cancel: threading.Event flows ToolContext → ToolExecutor → run_command_process, whose wait loop polls it on a 0.1s interval and killpgs the child's process group the instant it's set. The worker owns its own Popen, so it kills its own child — no cross-thread registry; the Event stays the only cross-thread signal; request_cancel is unchanged.
• The tool loop raises GenerationCancelled (keyed off the event, immediately after executor.execute), routing through the same abort_turn (⏹ aborted) path as the model-stream cancel.
• No orphaned tool_call: before raising, it rolls the cancelled model step out of history (del self._history[history_before_reply:]), so an assistant tool_call with no matching result is never re-sent on the next turn — matching the model-stream cancel's clean discard. Prior completed steps stay; partial command output already streamed to the pane stays visible.
• cancel=None (the default REPL executor) is behaviorally equivalent to before — the poll loop merely chunks the wait; a runaway child is still killed at the timeout deadline.

Verification

Phase gate (green):

ruff / ruff format / mypy --strict → all pass
pytest -q → 1451 passed

New tests (red-first): test_cancel_kills_process_group_fast (real sleep 30 child → cancel mid-run → killed fast, process group dead via killpg(pgid,0)→ProcessLookupError, reader thread joined), test_cancel_none_completes_normally, test_cancel_during_tool_execution_aborts (loop raises, history rolls back to just the user message — no orphaned tool_call), test_request_cancel_kills_running_command_and_aborts (TurnRunner → abort_turn, isolated from the model-stream backstop via the history-rollback assertion).

Live validation — gemma4:31b-cloud, full-screen app (SHELLPILOT_UI=app): model called run_command(sleep 60) → approved → child running (real pid) → Ctrl-C → child gone in 0.046s (not the 60s timeout) → ⏹ aborted rendered, indicator cleared, no orphaned child process, app responsive after (/status works). /status showed 2 messages in context = the two user messages only, no orphaned assistant tool_call — live confirmation of the history-rollback.

Targets ui-rework. Does not touch main.