feat: execute post run cleanup when workflow is cancelled (#37275)

## Fixes #36983

## Summary
1. Add transitional `Cancelling` status (between `Running` and
`Cancelled`); cancel flow marks active tasks `Cancelling`, runner
finalizes to `Cancelled` on terminal result.
2. Taskless jobs cancel directly (no runner to finalize).
3. Runner-protocol responses map `Cancelling` → `RESULT_CANCELLED`.
4. Run/job aggregation treats `Cancelling` as active.
5. Status mapping/aggregation tests + en-US locale added.

**Problem**
When a workflow was cancelled from the UI, jobs were marked cancelled
immediately, which could skip post-run cleanup behavior.

## Solution
Use a transitional status path:
Running → Cancelling → Cancelled
This allows runner finalization and cleanup path execution before final
terminal state.

**Testing**

> 1. go test -tags "sqlite sqlite_unlock_notify" ./models/actions -run
"TestAggregateJobStatus|TestStatusAsResult|TestStatusFromResult"
> 2. go run
github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4 run
./models/actions/... ./routers/api/actions/runner/...

## Related
- act_runner: https://gitea.com/gitea/act_runner/pulls/825 —
independent; this PR's capability gate keeps legacy runners on the
immediate-cancel path. The new flow activates only for runners that
advertise the `cancelling` capability.

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>

routers/api/actions/runner/runner_test.go

@@ -0,0 +1,86 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"testing"
+
+	actions_model "code.gitea.io/gitea/models/actions"
+
+	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+	"github.com/stretchr/testify/assert"
+)
+
+type capabilityRegisterRequest struct {
+	*runnerv1.RegisterRequest
+	capabilities []string
+}
+
+func (r *capabilityRegisterRequest) GetCapabilities() []string {
+	return r.capabilities
+}
+
+type capabilityDeclareRequest struct {
+	*runnerv1.DeclareRequest
+	capabilities []string
+}
+
+func (r *capabilityDeclareRequest) GetCapabilities() []string {
+	return r.capabilities
+}
+
+func TestRunnerRequestHasCancellingCapabilityTypedAccessor(t *testing.T) {
+	registerReq := &capabilityRegisterRequest{
+		RegisterRequest: &runnerv1.RegisterRequest{},
+		capabilities:    []string{runnerCapabilityCancelling, "other"},
+	}
+	hasCapability, known := runnerRequestHasCancellingCapability(registerReq)
+	assert.True(t, hasCapability)
+	assert.True(t, known)
+
+	declareReq := &capabilityDeclareRequest{
+		DeclareRequest: &runnerv1.DeclareRequest{},
+		capabilities:   nil,
+	}
+	hasCapability, known = runnerRequestHasCancellingCapability(declareReq)
+	assert.False(t, hasCapability)
+	assert.True(t, known)
+
+	hasCapability, known = runnerRequestHasCancellingCapability(nil)
+	assert.False(t, hasCapability)
+	assert.False(t, known)
+}
+
+func TestApplyDeclareRequestToRunnerPreservesUnknownCapabilityState(t *testing.T) {
+	runner := &actions_model.ActionRunner{
+		HasCancellingSupport: true,
+	}
+	req := &runnerv1.DeclareRequest{
+		Version: "1.2.3",
+		Labels:  []string{"linux"},
+	}
+
+	cols := applyDeclareRequestToRunner(runner, req)
+	assert.Equal(t, []string{"agent_labels", "version"}, cols)
+	assert.True(t, runner.HasCancellingSupport)
+	assert.Equal(t, "1.2.3", runner.Version)
+	assert.Equal(t, []string{"linux"}, runner.AgentLabels)
+}
+
+func TestApplyDeclareRequestToRunnerUpdatesTypedCapabilityState(t *testing.T) {
+	runner := &actions_model.ActionRunner{
+		HasCancellingSupport: true,
+	}
+	req := &capabilityDeclareRequest{
+		DeclareRequest: &runnerv1.DeclareRequest{
+			Version: "1.2.3",
+			Labels:  []string{"linux"},
+		},
+		capabilities: []string{},
+	}
+
+	cols := applyDeclareRequestToRunner(runner, req)
+	assert.Equal(t, []string{"agent_labels", "version", "has_cancelling_support"}, cols)
+	assert.False(t, runner.HasCancellingSupport)
+}