[CI] fix cancel-ci listing that matched no runs (#3123)

The cancel workflow listed unfinished runs with
`gh api -X GET repos/.../actions/runs -f status=$status`. gh treats
-f/-F fields as request-body parameters; on a GET they do not reach the
query string, so the status filter matched nothing and the workflow
always reported "no unfinished runs found" and cancelled nothing (each
run finished in a few seconds without ever entering the cancel path).

Fix: put query params (branch, per_page, page) directly in the API path
and filter non-terminal status client-side in jq, which is immune to the
-f/-F body quirk. Also:
- Fetch the most-recent pages (created-desc) instead of a per-status
  sweep; in-flight runs are always among the newest, so this stays
  bounded on busy repos while still covering every unfinished run.
- Print resolved inputs and each matched run (id/status/name) so a
  no-op is diagnosable at a glance.
- Make the dry-run banner unmistakable so an accidental dry run is not
  mistaken for a real cancel.

Verified against the live API: the client-side filter correctly matches
the in_progress run the old query missed.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>