Cancel an ingest job (cooperative)

Asks the job's durable runner to stop. Cancellation is COOPERATIVE: an upstream write already in flight cannot be recalled, so the stop lands at the next slice boundary — typically within a few seconds, and at most one back-off interval on a job that is being rate limited. Chunks written before the stop REMAIN STORED, remain recallable and remain billed; the job's terminal row names how many, so only the remainder need be re-ingested.

cancelled: true means a running job was signalled. cancelled: false means there was nothing to stop — read status to tell which: a terminal status means the job had already finished (its writes completed and were billed in full), while processing means this deployment has no durable runner bound and cannot stop background work. The two are reported apart deliberately, because acting on them differs.

Requires the ingest:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying ingest:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES ingest:write — every key minted before scoping keeps working here.