fix(runtime): mount the two operator run-lifecycle verbs the ledger already declares

`POST /automation/:name/runs/:runId/cancel` and `.../restore-suspension` were
declared in `route-ledger.ts` and answered by the `/automation` domain handler,
but nothing registered them on the HTTP router: `registerAutomationRoutes` in
`dispatcher-plugin.ts` mounts one literal registration per automation route and
gained neither. Both URLs answered Hono's `notFound` at runtime while every
ledger-reading guard passed them — the class the route-ledger to live-mount
parity gate (#7526) exists to catch, and the class it caught this in.

Two literal `server!.post` registrations, mirroring the `resume` arm beside
them. They carry no authority logic: the gate stays the single
`isRunLifecycleWrite` predicate in `domains/automation.ts` on the ADR-0095
posture rung, required unconditionally.

The dogfood authz probe blind-spot census moves with the population it
measures: the runtime ledger reads 82 rows instead of 80. Both new rows carry
`domain: '/automation'`, an already-classified key, so `reachable` moves with
`population`, `blindSpot` stays 0 and the key count stays 21.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

Author: claude

packages/qa/dogfood/test/authz-conformance.matrix.ts

@@ -25,7 +25,7 @@
 // dispatcher domain files.
 //
 // The population comes from `packages/rest/src/rest-route-ledger.ts` (94 rows
-// / 19 families) and `packages/runtime/src/route-ledger.ts` (80 rows / 21
+// / 19 families) and `packages/runtime/src/route-ledger.ts` (82 rows / 21
 // domains) because those two are enumerated from a RUNNING server and guarded
 // in both directions by their own conformance tests — so a new family or
 // domain cannot be silently absent from them, and therefore cannot be silently

packages/qa/dogfood/test/authz-probe-blind-spot.census.ts

@@ -106,7 +106,7 @@
 //     `RestServer.getRoutes()` on a booted server and guarded per route by
 //     `rest-route-ledger.conformance.test.ts`. It reaches all 17 registrars;
 //     this table reaches 1.
-//   `packages/runtime/src/route-ledger.ts`: 80 rows over 21 domains. Its
+//   `packages/runtime/src/route-ledger.ts`: 82 rows over 21 domains. Its
 //     machine contract is DOMAIN-level, by live registry introspection
 //     (`domainRegistry.list()`), the per-route rows being documentation. It
 //     covers all 15 `async handle*(` methods in `http-dispatcher.ts` and all
@@ -295,11 +295,16 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     kinds: ['ROUTE_ENUMERATION'],
     probes: 1,
     keys: 21,
-    population: 80,
-    reachable: 80,
+    // [#13953] 80 -> 82: the two operator run-lifecycle rows
+    // (`POST /automation/:name/runs/:runId/cancel` and `.../restore-suspension`).
+    // Both carry `domain: '/automation'`, an EXISTING key, so `reachable` moves
+    // with `population`, `blindSpot` stays 0 and `keys` stays 21 — a population
+    // that grows inside an already-classified domain mints nothing new.
+    population: 82,
+    reachable: 82,
     blindSpot: 0,
     populationRule: 'ledger rows inside ROUTE_LEDGER; reachable = rows carrying a `domain` (each distinct value mints a key)',
-    controls: { "route: '": 80, "domain: '": 80, RouteLedgerEntry: 2 },
+    controls: { "route: '": 82, "domain: '": 82, RouteLedgerEntry: 2 },
     note:
       'The dispatcher half. Its machine contract is DOMAIN-level by live registry introspection ' +
       '(domainRegistry.list()), guarded in BOTH directions by route-ledger.conformance.test.ts: every ' +

packages/runtime/src/dispatcher-plugin.ts

@@ -1553,6 +1553,39 @@ export function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plu
                     }
                 });
 
+                // [#13953] The two OPERATOR RUN-LIFECYCLE verbs — cancel a
+                // suspended run (ADR-0044) and put back the suspension a failed
+                // resume consumed (#13909). LITERAL registrations, one per verb,
+                // for the reason `resume` above is one: nothing else registered
+                // on this router answers a 5-segment POST under `/automation`,
+                // so a ledger row with no `server!.post` here answers Hono's
+                // `notFound` at runtime while every ledger-reading guard passes
+                // it — the exact class the route-ledger ↔ live-mount parity gate
+                // (#7526) exists to catch, and the class it caught this in.
+                //
+                // ⛔ These arms carry NO authority logic. The gate is one
+                // predicate in `domains/automation.ts` (`isRunLifecycleWrite`,
+                // the ADR-0095 posture rung, unconditional) read by the gate and
+                // by both route arms there; a second spelling here would be a
+                // second policy that happens to agree today.
+                server!.post(`${base}/automation/:name/runs/:runId/cancel`, async (req: any, res: any) => {
+                    try {
+                        const result = await dispatcher.dispatch('POST', `/automation/${req.params.name}/runs/${req.params.runId}/cancel`, req.body, req.query, { request: req });
+                        sendResult(result, res);
+                    } catch (err: any) {
+                        errorResponse(err, res);
+                    }
+                });
+
+                server!.post(`${base}/automation/:name/runs/:runId/restore-suspension`, async (req: any, res: any) => {
+                    try {
+                        const result = await dispatcher.dispatch('POST', `/automation/${req.params.name}/runs/${req.params.runId}/restore-suspension`, req.body, req.query, { request: req });
+                        sendResult(result, res);
+                    } catch (err: any) {
+                        errorResponse(err, res);
+                    }
+                });
+
                 server!.get(`${base}/automation/:name/runs/:runId/screen`, async (req: any, res: any) => {
                     try {
                         const result = await dispatcher.dispatch('GET', `/automation/${req.params.name}/runs/${req.params.runId}/screen`, undefined, req.query, { request: req });