#3702 workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Summary

swamp workflow cancel --server <url> --ca-cert <file> accepts --ca-cert (and SWAMP_CA_CERT) through the shared remote options but never uses it. The cancel request is a plain global fetch with no TLS client, so against a server whose certificate is signed by a private CA the cancel fails with a TLS error even though the same --ca-cert works for workflow run --server and worker connect.

Where

src/cli/commands/workflow_cancel.ts:973 posts to the cancel URL with fetch(cancelUrl, { method, headers, body, signal }). Other remote paths build their client with createTlsHttpClient and the CA certificates from getEnvCaCerts (src/cli/remote_run.ts) and pass it as client.

Expected

workflow cancel --server trusts the CA from --ca-cert / SWAMP_CA_CERT the same way the other remote commands do, with flag-wins precedence (see #2359).

Found during

Triage of Lab #3699 (TLS trust-store review).