feat: distinguish 'cancelled' from 'failed' in _async_migrations status

[Kpa-clawbot]

Context

Raised by Munger in PR #1735 (round-1 review). Currently the _async_migrations.status enum collapses operator-initiated cancellation into failed, which makes triage harder ("did this die because we killed it, or because of a real fault?").

Proposal

Add a cancelled status distinct from failed in:

• cmd/ingestor/async_migration.go: defer in RunAsyncMigration detects errors.Is(err, context.Canceled) and writes status='cancelled' instead of failed.
• cmd/server/async_migrations.go: mapAsyncStatus adds cancelled → cancelled enum.
• public/warmup-banner.js: surface cancelled as an info-tone line (not error), and treat it as auto-dismiss-eligible.

Why

failed should mean "the migration tried and could not complete due to an error worth investigating." Operator-initiated cancellation (shutdown, SIGTERM) is not that.

[Kpa-clawbot]

Severity: P3 — DX/operability nicety; no correctness or perf impact.

Claim: confirmed. The proposed flow in PR #1735 collapses any non-success into failed. SIGTERM/shutdown is indistinguishable from a genuine fault in _async_migrations.status.

Code today: cmd/ingestor/async_migration.go (and the chunked migration helper introduced in #1735). Status enum on the read side: cmd/server/async_migrations.go::mapAsyncStatus. Warmup banner consumer: public/warmup-banner.js.

Findings:

• (munger): The information value of distinguishing operator cancel from fault is real for ops — false fault alarms train operators to ignore the banner. Cheap fix, durable benefit.
• (kent-beck): Three small typed changes (deferred err check → status, server enum map, UI tone). Each independently testable: write a test that cancels a context mid-migration and asserts status='cancelled'.

Fix path:

1. async_migration.go defer: if errors.Is(err, context.Canceled) { writeStatus("cancelled") } else if err != nil { writeStatus("failed") }
2. mapAsyncStatus add cancelled → "cancelled".
3. warmup-banner.js route cancelled to info tone + auto-dismiss eligible.
   Effort: S.

Dup check: searched "cancelled async migration status" — none.

Blocker: depends on PR #1735 merging first.

Triage verdict: ready-to-fix

[Kpa-clawbot]

Auto-fix chain dispatched (cron v6.2, 2026-06-17 07:06 UTC). Will follow up with PR link or stop reason.