[pelikhan]

Operators need a bounded way to retire obsolete worker-contract backlog from the CLI without clearing the queue or manually assembling Work IDs. This adds gh aw work cancel --obsolete using the existing maintenance and specification semantics, implemented entirely in Go.

Changes

• Add cancel as an alias of cancel-work, with --obsolete, --limit (1..256, further bounded by Policy), and read-only --dry-run.
• Select available, unclaimed, unpinned Work with no delivery barrier and an incompatible available active deployment contract. Exclude elapsed Work and missing/unavailable deployments; select in UTF-8 byte order.
• Reuse administrator-authenticated publication with operation version: 1 and reason worker_contract_obsolete. Fresh ledger checks reject stale batches, and stable-request retries recover only original targets.
• Preserve Claims, Results, barriers, native reservations, policy/epoch/limits, fairness debt and history. Add spec-based Go regressions, operator integration tests, reference/spec documentation and a patch changeset.

The cancellation prerequisite is already on the base via #76126; no prerequisite commits are imported.

Validation

• make fmt
• go test ./pkg/cli ./pkg/workqueue -run 'TestWorkCancelObsolete|TestObsoleteWorkSelection' -count=1
• Additional focused existing cancellation contract regressions and JavaScript maintenance suites passed independently; the command and new Go tests do not invoke JavaScript.
• Required impacted tests ran through make agent-report-progress. Its initial lint findings were fixed, then make agent-report-progress-no-test passed the final lint/build/schema/workflow-drift gates, including 365 compiled workflows.

Live validation limitation

The live --dry-run against github/gh-aw stalled during the Git ledger read and was stopped. REST reads confirmed the queue reference stayed unchanged. Live selection remains unverified; no live cancellation or workflow dispatch was performed.

Example preview:

gh aw work cancel --obsolete --repo OWNER/REPO \
  --limit 256 --request-id obsolete-batch-1 --dry-run --json