feat(automation): add configurable continuation and coordinator access (#2943)

docs/public/websocket-api.md

@@ -489,6 +489,7 @@ automation.enable
 automation.get
 automation.list
 automation.run.delete
+automation.run.stop
 automation.runs.delete_all
 automation.runs.list
 automation.runs.list_workspace
@@ -505,6 +506,18 @@ automation.webhook.reveal_secret
 
 These are trusted local-administration operations. In particular, `secrets.reveal` and `automation.webhook.reveal_secret` make the lack of WebSocket authentication security-critical.
 
+`automation.run.stop` requires `automation_id` and `run_id`. It cancels the
+selected open run's exact task/session/turn binding and returns `{run_id,
+status}`. A stale or terminal binding returns not found; it never stops another
+turn that happens to share the same task or session.
+
+Automation payloads expose `task_mode` (`automation_run` or `normal_task`) and
+`repository_mode` (`workspace_default`, `selected`, or `none`). Hidden runs may
+omit workflow and repository data and use a Local scratch workspace. Normal
+tasks require a workflow and remain visible in Kanban and the sidebar. A
+repository-required provider trigger rejects `repository_mode=none` before it
+creates an `AutomationRun`.
+
 ### GitHub and GitLab
 
 ```text