#4196 workflow cancel --server does not send SWAMP_SERVE_EXTRA_HEADERS

Summary

The help for --server (withRemoteOptions in src/cli/remote_run.ts) points at SWAMP_SERVE_EXTRA_HEADERS for proxy and tunnel pass-through headers, but the workflow cancel --server request never sends them. Behind a proxy or tunnel that requires such a header, the cancel should be refused or fail while workflow run --server against the same URL gets through.

Where

buildServerCancelRequest in src/cli/commands/workflow_cancel.ts sets only Content-Type and Authorization, and that file has no reference to resolveExtraHeaders. The WebSocket paths in remote_run.ts, serve_upstream.ts and worker_connect.ts all apply it.

Expected

workflow cancel --server sends the headers from SWAMP_SERVE_EXTRA_HEADERS like the other remote commands.

Notes

Found by reading the code during triage of Lab #3702 (cancel ignoring --ca-cert), not by running it against a real proxy. src/libswamp/auth/server_login.ts has no reference to the extra headers either, so auth server-login may share the gap; that was not investigated.