Record a person's Stop as a stop, not a failed action

[davidmckayv]

What this changes

A person pressing Stop mid-action aborts the request, and the transport reports it as The action was stopped.. The gateway wrote that outcome beside the decision row as a failure — the same computer.action_failed type it writes for an unreachable computer or a timeout. The row's message was right, but anything counting failures by type (the natural way to watch for outages) read every Stop as one. This was surfaced as a follow-up while merging #403, which fixed the message but not the type.

A stop now writes its own event type, computer.action_stopped:

• ComputerStoppedError (a subclass of ComputerUnavailableError, so everything catching an unavailable computer to tell the model is unchanged) is thrown on both stop paths in client.ts — the pre-fetch guard and the mid-flight abort.
• The gateway detects it in the action-catch and types the row computer.action_stopped, carrying the same message.
• The audit page groups it with the other did-not-happen outcomes (outcome.ts), and a policy dry-run skips it the way it skips a failure (policy-dry-run.ts) — both sit beside a decision row that is already scored. REPLAYABLE_EVENT_TYPES never included either, so the dry-run query already excludes it.

Where it runs

• New state that outlives a request? None. One new audit event type; the row still goes to Postgres via the same writer.
• Second replica? No change: any replica writes the same row.
• Serialised / fanned out / new listener? No.

Boundary and audit

• Every acting call still goes through the gateway. No new refusals on acting calls. Nothing new trusted from the client — the stop is the server's own AbortSignal.

Proof

• computer-client.test.ts: an already-stopped request rejects with ComputerStoppedError, which is still an instanceof ComputerUnavailableError.
• computer-gateway.test.ts: a permitted command stopped mid-flight records computer.action_allowed then computer.action_stopped (not action_failed), message still says stopped.
• bun test server/ → 1807 pass, 0 fail; format/lint/typecheck/build clean.