Core: cancel moved runs, retry bookkeeping, progress cap, safer classification

- A run whose item leaves In Progress is killed, gets a [worker] cancel comment,
  frees its terminal slot and serialize group and keeps its thread id; if the
  kill fails the slot stays taken and the cancel is retried next tick.
- Transient retries are the same logical round: they do not count toward
  max_rounds_per_thread and do not trigger a max-rounds rebuild.
- New project setting max_progress_rounds (default 12): after that many
  consecutive [progress] rounds the item goes to Waiting (answerer) with a note.
- retry/rebuild markers are consumed only after the run launched, so a failed
  start no longer leaves an In Progress item that is never picked again; a
  rebuild is no longer reported as a retry.
- State is saved after every finished round and every launched run.
- Failure classification: transient patterns only look at the tail, and an
  exit-0 failure is logic (never retried) unless the tail shows a transient error.
- First-line tag: tolerate BOM and a leading code fence / rule line.
- Start comment notes when a handoff summary was attached.

config/schema.json

@@ -131,6 +131,7 @@
         },
         "timeout_hours": {"type": "number", "minimum": 0},
         "max_rounds_per_thread": {"type": "integer", "minimum": 1},
+        "max_progress_rounds": {"type": "integer", "minimum": 1},
         "notify": {
           "type": "object",
           "additionalProperties": false,