#2651 Tidy up tests and helpers from the serve suspended-run cancel

Follow-ups from the verification reviews of swamp-club#2514. None changes behaviour.

• src/libswamp/workflows/cancel_suspended_test.ts, test 'reveals a non-suspended status only after authorization': the denied case asserts only inside if (deniedEvent?.kind === 'error'). Assert the kind first, so the test cannot pass without checking anything.
• cancelActor in src/serve/handlers/shared.ts repeats the initiatedBy name resolution in src/serve/audited.ts (resolved user name, else principalToString). Share one helper so the audit and cancel_reason names cannot drift.
• src/serve/suspended_run_cancel.ts has no unit test file. The integration suite covers it, but not the no-registry early return, the not_suspended mapping, or awaitAbortedRun's timeout. Add suspended_run_cancel_test.ts.
• The WebSocket workflow.cancel handler (handleWorkflowCancel, abortActiveWorkflowRun in src/serve/handlers/workflow_handlers.ts) is tested only through integration/serve_cancel_suspended_test.ts. Add unit tests beside it for the busy and re-registered branches.
• The denied audit event on a refused HTTP cancel (the 403 branches of the cancel endpoint in src/cli/commands/serve.ts) is untested. Extract the refusal into a function and test it.
• ScheduledExecutionService.cancelByRunId and cancelAllRuns gained a reason parameter with no test. Add one that checks the abort reason.