feat(refresh): propagate app refresh cancellation

[hubab1]

Summary

• add FIFO caller-owned app-refresh permits and a throwing cancellation boundary while preserving the legacy result API
• propagate active cancellation through rankings, metrics, ratings, and reviews; preserve committed batches and pages and await structured children before release
• token-scope progress and finish observations before promotion while keeping provider-originated cancellation as an ordinary failure
• make the daily scheduler stop and record a canceled app refresh without marking ratings or reviews successful

Validation

• 25 focused cancellation, rating, and scheduler tests passed
• full suite passed: 358 tests, 0 failures, 0 skips
• signed macOS build passed and strict codesign verification succeeded
• Swift parse and diff checks passed
• two independent P1/P2 reviews found no remaining issues

Stack

Draft PR stacked on #62 / 35a-headless-refresh-core. This remains part of the category-B manual headless-refresh architecture review; scheduling wiring and aggregate UI observation remain later slices.