Cancellation history needs explicit audit provenance

When cancellation hides an active child record but preserves its evidence, record a distinct idempotent cancellation audit event containing the parent, child, source, optional reason, and occurrence time. Project cancelled children into a read-only history surface under existing scope and redaction policy.

Keep active counters, queues, and current-state projections unchanged unless the product contract says otherwise. Separate API cancellation from broader manual deletion when their scopes and audit effects differ. Exact correlation to an external event requires durable identifiers, not log proximity alone.