fix: remove no-op SaveJobs calls, fix PendingRuns lifecycle and cap

Implements items 4-5 of the whole-project review's suggested order
(docs/PROJECT_REVIEW_PLAN.md):

- Drop the three SaveJobs calls in the run lifecycle (startRunLocked,
  executeRun, SetGlobalPause): none of them change a durable Job field,
  everything they touch lives on JobRuntime, which is never persisted.
  Retire TestStartRunLockedRollbackOnSaveFailure with the rollback it
  guarded, since a run can no longer fail to start this way.
- Clear PendingRuns (the "queue" overlap policy's backlog) when a job is
  disabled or the scheduler is globally paused, so resuming or
  re-enabling a job no longer replays a deferred run left over from
  before the pause/disable. Cap it at maxPendingRuns (10) so a job whose
  runs take longer than its own interval stops accumulating an unbounded
  backlog. Surface the queued count in the details pane via DisplayStats.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/format_test.go

@@ -126,6 +126,17 @@ func TestDisplayStats(t *testing.T) {
 	if got := DisplayStats(rtNoFail); got != wantNoFail {
 		t.Errorf("DisplayStats no-fail = %q, want %q", got, wantNoFail)
 	}
+
+	// A "queue" overlap backlog is appended to whichever form applies, so it stays
+	// visible even before the first run has completed.
+	if got, want := DisplayStats(&domain.JobRuntime{PendingRuns: 2}), "No runs recorded, 2 queued"; got != want {
+		t.Errorf("DisplayStats pending, no runs = %q, want %q", got, want)
+	}
+	rtPending := &domain.JobRuntime{RunCount: 5, FailCount: 2, LastDurationMS: 450, AvgDurationMS: 380, MaxDurationMS: 520, PendingRuns: 3}
+	wantPending := "5 runs, 2 failed, last 450 ms, avg 380 ms, max 520 ms, 3 queued"
+	if got := DisplayStats(rtPending); got != wantPending {
+		t.Errorf("DisplayStats pending = %q, want %q", got, wantPending)
+	}
 }
 
 func TestEventLine(t *testing.T) {