default: patch

Owners of private repositories can cancel their runs

knotless run cancel (and run_cancel) on a private repository was refused, Scope does not permit create in at://…/space/dev.knotless.space/…, because the private repository's space type did not list dev.knotless.cancel, and a PDS grants a login only the collections it lists. It lists it now: once knotless publishes its lexicons with it, log in again to allow it. A refusal like that, from a PDS that did not grant what your login asks for, no longer says your login is older than what knotless asks for: it says the PDS did not grant it, and why.