fix: correlate SSE traces and cancellation

[KDB-Wind]

What changed

• propagate the existing traceId alongside taskId through SSE meta events and lifecycle logs
• finish cancelled trace runs exactly once with CANCELLED, including cancellation-before-handle races
• add stage-aware, correlation-safe diagnostics without logging user-controlled conversation IDs or exception messages
• address the three existing CodeQL log-injection data flows in touched SSE files
• add focused trace/cancellation regression tests and update the frontend SSE meta contract
• document affected-check routing and the external tasks that still require real infrastructure or administrator judgment

Why

The Better Harness reassessment found that a maintainer could not reliably correlate SSE stage failures, cancellation cleanup, and the final trace outcome. The cancellation path also bypassed trace finalization, allowing runs to remain RUNNING.

Validation

• ./mvnw -B -ntp -pl bootstrap -am -Dtest=StreamChatTraceRunnerTest,StreamChatPipelineTest -Dsurefire.failIfNoSpecifiedTests=false test
• ./mvnw -B -ntp spotless:check verify
• cd frontend && npm run test -- src/hooks/__tests__/useStreamResponse.test.ts
• cd frontend && npm run lint && npm run test:coverage && npm run build

All passed locally. This PR intentionally does not run real integration infrastructure, dismiss alerts, change rulesets, trigger AI review, or merge itself.

External follow-up

Real integration runs, staging credential validation, secret rotation, database migration, default-branch alert disposition, and longitudinal task evidence remain documented in docs/external-governance-operations.md.