feat: abort sub-agent jobs (real kill) + runner usage capture into JobRecord.usage

Wave 4 (agent-side observability + control), reconciled with the dock
contract (master relay 2026-09):

- abortJob in src/server/jobs.ts, exported through the server barrel for
  POST /api/activity/abort (master's thin route): fires the job's
  AbortController (real kill — the in-flight model call aborts, not just
  the next loop check), drops any queued result steer, flips the record
  to error "Aborted by learner" + activity "aborted" synchronously, and
  queues a one-line abort steer (buildAbortSteer) through the same wake
  pipeline so the teacher's promise doesn't hang in the lesson. Shares
  the result steer's deterministic id space, so abort + racing result
  can never both deliver (steerDelivered dedupe).
- Abort registry (src/agent/subagents/aborts.ts) on globalThis, mirroring
  the wake pipeline's module-state pattern; runner registers/unregisters
  per run, so the route's module instance sees the loop's controller.
- Runner usage capture: LoopContext (abortSignal + onUsage) threads into
  all three kind loops; per-step usage folds via accumulateJobUsage into
  JobRecord.usage (model from config MODELS, absent-never-zero), flushed
  in runJob's finally so an aborted job's money record survives the kill.
- Contracts: JobUsage token fields optional + lastStep (most recent
  call's accounting, for the dock's per-blob context line vs
  CONTEXT_LIMITS); SubagentResultMeta.aborted; AbortSteerMessage;
  buildAbortSteer; SteerMessage union generalized.
- demo-builder/visual-maker accept abortSignal + onUsage (visual folds
  generateText usage per iteration).
- stillRunning/finishJob/jobContext guards: an aborted job is never
  overwritten by the runner (terminal no matter what the wake does);
  failJob and the pump's finalizeJob keep the flip.
- UI: abort steer renders a quiet aborted chip (job-aborted-badge).
- Prompt 20-jobs.md: one line about aborted jobs.

Tests: accumulateJobUsage folds (undefined-preservation, lastStep),
runner usage capture, real-kill abort (sync flip, silent unwind,
abort steer wakes), usage-so-far survives the kill, aborting a
delivering job drops the queued result steer, outcome reasons,
abort-chip render. 330/330, typecheck/lint/build green.

src/agent/subagents/aborts.ts

@@ -0,0 +1,50 @@
+/**
+ * Job abort registry — WHO can actually kill a running sub-agent.
+ *
+ * The runner creates one AbortController per running job and registers it
+ * here; the abort path (src/server/jobs.ts abortJob, driven by the dock's
+ * END button via POST /api/jobs/[jobId]/abort) fires it through fireJobAbort.
+ * Two module trees meet: the runner (src/agent) and the endpoint
+ * (src/server) — the registry lives on globalThis for the same reason as
+ * the turn registry and the wake pipeline: Next dev gives each route entry
+ * its own module instances, so a module-level Map would be a different
+ * object in each. Placed under src/agent (server→agent imports are an
+ * established direction; agent→server is not — see chat-handler).
+ *
+ * 2026-09 abort semantics (user-decided): REAL KILL, not mark-and-abandon —
+ * the controller aborts the in-flight model call (agent.generate /
+ * generateText abortSignal); headless tool runs are best-effort (the next
+ * model call is where a hung one dies). The route owns the bookkeeping
+ * (status error "Aborted by learner" + the abort steer); the runner only unwinds.
+ */
+
+interface LhAbortGlobal {
+	__lhJobAborts?: Map<string, AbortController>;
+}
+
+function registry(): Map<string, AbortController> {
+	const g = globalThis as typeof globalThis & LhAbortGlobal;
+	return (g.__lhJobAborts ??= new Map());
+}
+
+/** The runner registers its controller at job start (idempotent overwrite). */
+export function registerJobAbort(jobId: string, controller: AbortController): void {
+	registry().set(jobId, controller);
+}
+
+/** The runner unregisters in its finally block (job settled or unwound). */
+export function unregisterJobAbort(jobId: string): void {
+	registry().delete(jobId);
+}
+
+/** Abort a running job's loop. Returns false when no controller is live —
+ * the job's loop is not executing (crashed, or in the delivering-result
+ * phase where the runner has already returned); the caller then owns the
+ * whole abort on the record side. */
+export function fireJobAbort(jobId: string): boolean {
+	const controller = registry().get(jobId);
+	if (!controller) return false;
+	registry().delete(jobId);
+	controller.abort();
+	return true;
+}