docs: mark subagent cancellation decision as candidate

Author: rynfar

.pylon/features.yaml

@@ -268,7 +268,7 @@ decisions:
 
   turn-scoped-subagent-cancellation:
     area: runtime-reliability
-    state: shipped
+    state: candidate
     owner: pylon-prime-integration
     decision: redesign
     pylon_refs:
@@ -280,7 +280,7 @@ decisions:
       - https://github.com/PrimeIntellect-ai/prime-agent/pull/464
       - https://github.com/PrimeIntellect-ai/prime-agent/pull/1253
       - https://github.com/PrimeIntellect-ai/prime-agent/tree/c382f09856d4a8c8d2b765179657047d58691f25
-    fork_change: none
+    fork_change: candidate
     upstream_support: Prime through c382f09856d4 keeps two cancel semantics. `AgentSession.requestAbort()` deliberately leaves active RLM child runs alive (PR #346 pinned that with a characterization test) while only `abort()` and `abortForUpdateRestart()` cascade, and every user-facing cancel path routes through `requestAbort()`. PR #464 made per-child cancellation explicit but never bound it to a turn abort, and open PR #1253 scopes child cancellation to kernel host teardown only. No upstream contract cancels the children a cancelled turn owns.
     revisit_when:
       - Prime makes a user-facing turn abort cancel the child runs it owns, or exposes an equivalent turn-scoped cancellation contract.