fix: mark losing-branch nodes as cancelled after df.race completes

[Copilot]

After a df.race() completes, the losing branch's sub-orchestration is cancelled by duroxide internally, but df.nodes rows were never updated — leaving them as running or pending indefinitely. Dashboards and df.instance_nodes queries would show ghost in-flight work for already-completed instances.

Schema

nodes_status_chk on df.nodes is widened to include 'cancelled'. Migration in sql/pg_durable--0.2.2--0.2.3.sql (constraint added NOT VALID — no table scan on upgrade). Version bumped to 0.2.3.

New activity: cancel_subtree_nodes

Bulk UPDATE df.nodes SET status = 'cancelled' WHERE id = ANY($1) AND status NOT IN ('completed', 'failed', 'cancelled'). The terminal-state guard ensures nodes that happened to complete before select2() returned are not disturbed.

Orchestration fix: execute_race_node

After ctx.select2() returns the winner, the losing branch root is known. A collect_subtree_node_ids() DFS walk collects every node reachable from that root (following left_node, right_node, condition_node, and extra_nodes), then schedules cancel_subtree_nodes. Cancellation is best-effort — a failure logs a warning but does not fail the workflow.

-- Before: df.instance_nodes after race completes
 node_type | status
-----------+---------
 SQL       | completed   ← winner
 SLEEP     | running     ← ghost

-- After
 node_type | status
-----------+-----------
 SQL       | completed
 SLEEP     | cancelled

Tests

tests/e2e/sql/24_race_loser_cancelled.sql covers two scenarios: a single-node losing branch (SLEEP) and a multi-node losing branch (THEN + SQL sequence). Both use a poll loop rather than a fixed sleep to wait for the cancel activity to settle.