fix: remove no-op SaveJobs calls, fix PendingRuns lifecycle and cap

Implements items 4-5 of the whole-project review's suggested order
(docs/PROJECT_REVIEW_PLAN.md):

- Drop the three SaveJobs calls in the run lifecycle (startRunLocked,
  executeRun, SetGlobalPause): none of them change a durable Job field,
  everything they touch lives on JobRuntime, which is never persisted.
  Retire TestStartRunLockedRollbackOnSaveFailure with the rollback it
  guarded, since a run can no longer fail to start this way.
- Clear PendingRuns (the "queue" overlap policy's backlog) when a job is
  disabled or the scheduler is globally paused, so resuming or
  re-enabling a job no longer replays a deferred run left over from
  before the pause/disable. Cap it at maxPendingRuns (10) so a job whose
  runs take longer than its own interval stops accumulating an unbounded
  backlog. Surface the queued count in the details pane via DisplayStats.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/CHANGELOG.md

@@ -32,6 +32,13 @@ the app icon (experimental).**
   loss mid-write can no longer leave a truncated or empty file. `Service.Stop()`
   is now called when the app quits, which also makes the run context
   cancellation reach in-flight runs on shutdown.
+- Fixed the "queue" overlap policy's backlog (`PendingRuns`): it no longer
+  survives a global pause or a job being disabled, so resuming or re-enabling a
+  job can no longer replay a deferred run left over from before the pause/
+  disable. It is also capped at 10 queued occurrences, so a job whose runs take
+  longer than its own interval no longer accumulates an unbounded backlog that
+  then runs back-to-back indefinitely. The job details pane now shows the
+  queued-run count (", N queued") whenever it is non-zero.
 
 **Jobs:**