Stop cancelled chat runs at frame and graph-write boundaries

[HomenShum]

An analyst could press Stop after a completed tool and still get later graph writes and next-stage progress. Returning from the inner step did not stop its caller; even a delay-level cancellation check left a microtask gap before the graph update.

The existing shared step now checks immediately before its synchronous graph callback, and every emitted frame uses one guarded snapshot. Pending waits cancel their timer and listener. Earlier results remain available and Retry completes normally. Source tours and the developer walkthrough now explain and link to these boundaries; their generator preserves the existing Stop/Retry guidance. Model-refresh PR #15 has no overlapping files.

Validation:

• Full suite: 117/117 pass on Node 22.22.2, including SQLite persistence/reopen scenarios. The first run had two missing native-binding failures; installing the existing better-sqlite3 binding resolved both without changing tests.
• 54 adapter/installed-SDK scenarios cover all waits, reduced motion, paused yields, microtask races, overlapping runs, a 16-run burst and 128 sequential stops with successful retries. Original source failed 40 of the first 41; independent review found an additional candidate 1 race, and 13 new cases fail that frozen candidate and pass this implementation.
• Independent Codex code-review and simplification approved the runtime and final documentation delta. The latter diff is SHA256 0d6b9380fd947b75165433dcc6a6372b11c54b5e86232b083208d34c7cb6f4e0; adapter SHA256 is 961078dc9a127169232e23175b551bb632ccd7af6daac88045b00f9161976d4c.
• Tour validation passes 3 tours/36 steps/11 source citations; repeated generation produces identical files. Typecheck, build, secret scan and production dependency audit pass.
• Chrome Stop/Retry preserves the earlier memo and holds the graph unchanged after stopping, then completes the retry. Exact microtask ordering is covered by SDK scenarios, not browser click timing.

Limits: full local prepush and provider calls were not run. CI checks this exact PR head separately. Five affected development dependencies covering seven advisories and the existing large-bundle warning remain outside this repair. The generated chat template has a separate cancellation pattern for follow-up. This publishes source changes; no hosted app deployment is claimed.