fix: remove no-op SaveJobs calls, fix PendingRuns lifecycle and cap

Implements items 4-5 of the whole-project review's suggested order
(docs/PROJECT_REVIEW_PLAN.md):

- Drop the three SaveJobs calls in the run lifecycle (startRunLocked,
  executeRun, SetGlobalPause): none of them change a durable Job field,
  everything they touch lives on JobRuntime, which is never persisted.
  Retire TestStartRunLockedRollbackOnSaveFailure with the rollback it
  guarded, since a run can no longer fail to start this way.
- Clear PendingRuns (the "queue" overlap policy's backlog) when a job is
  disabled or the scheduler is globally paused, so resuming or
  re-enabling a job no longer replays a deferred run left over from
  before the pause/disable. Cap it at maxPendingRuns (10) so a job whose
  runs take longer than its own interval stops accumulating an unbounded
  backlog. Surface the queued count in the details pane via DisplayStats.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/STANDARDS.md

@@ -79,6 +79,15 @@ change to their shape has to stay compatible on its own.
   mid-session (see [ROADMAP.md](ROADMAP.md)).
 - **`--start-in-tray` defers to config.** A stale autostart shortcut that still
   passes the flag does not hide the window when `KeepRunningInTray` is off.
+- **`JobRuntime.PendingRuns` (the "queue" overlap policy's backlog) is capped at
+  `maxPendingRuns` (10) and cleared on pause or disable.** A job whose runs take
+  longer than its interval stops accumulating backlog once the cap is hit —
+  further overlaps are dropped like the "skip" policy until the backlog drains
+  below the cap. `SetGlobalPause(true)` and `SetEnabled(id, false)` both zero
+  the counter, so resuming or re-enabling a job never replays a deferred run for
+  an occurrence that fired before the pause/disable. The details pane appends
+  ", N queued" to the statistics line via `DisplayStats` whenever the count is
+  non-zero.
 
 ## Out of scope