[flows-tinyflows] flows bug: resume and cancel races mislabel or tear down a live run #45

Moved from tinyhumansai#8023, which is closed in favour of this issue. Part of tinyhumansai#8055.

Two races in run bookkeeping, both rooted in a "finish" write that also matches running rows (drivers LIVE = ["running", "pending_approval"], tinyflows-drivers/src/catalog/runs.rs:34).

1. Resume's stale-graph refusal cancels a run another resume is executing (flows/ops/resume.rs:95-163). Resume B claims the run (mark_run_resuming → running); resume A sees a graph-hash mismatch, its finish_flow_run_row("cancelled") still matches, so A records cancelled and drops B's live checkpoint. B's side effects still fire; its final write (:417) returns false. The compat-rejection branch (:180-200) relabels B's row to failed with no matched-write check.
2. Cancel can tear down a resume that is starting (flows/ops/run_management.rs:25-89). Cancel reads pending_approval, run_registry::cancel returns false (resume not registered yet, resume.rs:247), resume registers and sets running, then cancel's finish write matches and drop_checkpoint runs. The resume's token is never signalled.
3. Related: RunRowFinalizer::drop (flows/ops/run_rows.rs:74) records interrupted on the flow summary even when the row was already terminal.

Fix: refuse when run_registry::is_in_flight holds, or use a parked-only (pending_approval) guarded write; only record the flow summary when the row write matched. Regression tests reproduce each interleaving first.

Done when: each defect above has a regression test that fails on the unfixed code and passes after the fix. Gates: cargo check (root + crates/openhuman-app), pnpm rust:layout, node scripts/ci/check-feature-forwarding.mjs, pnpm debug rust flows, and the touched crates' tests. RPC namespace strings, model-facing tool names and DomainEvent variant names stay unchanged unless the issue says otherwise.

Agent brief

• Files to consider (paths under crates/openhuman-core/src/ unless rooted): flows/ops/resume.rs, flows/ops/run_management.rs, flows/ops/run_rows.rs
• Research: Interleavings above; tinyflows_catalog::run_registry; drivers finish_flow_run/mark_run_resuming.
• Workflow: an implementing-an-epic step.
• Subagent: systematic-debugger.
• Dependencies: none.

Parent: tinyhumansai#8055