fix: remove no-op SaveJobs calls, fix PendingRuns lifecycle and cap

Implements items 4-5 of the whole-project review's suggested order
(docs/PROJECT_REVIEW_PLAN.md):

- Drop the three SaveJobs calls in the run lifecycle (startRunLocked,
  executeRun, SetGlobalPause): none of them change a durable Job field,
  everything they touch lives on JobRuntime, which is never persisted.
  Retire TestStartRunLockedRollbackOnSaveFailure with the rollback it
  guarded, since a run can no longer fail to start this way.
- Clear PendingRuns (the "queue" overlap policy's backlog) when a job is
  disabled or the scheduler is globally paused, so resuming or
  re-enabling a job no longer replays a deferred run left over from
  before the pause/disable. Cap it at maxPendingRuns (10) so a job whose
  runs take longer than its own interval stops accumulating an unbounded
  backlog. Surface the queued count in the details pane via DisplayStats.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/operations_test.go

@@ -217,6 +217,23 @@ func TestSetEnabledToggles(t *testing.T) {
 	}
 }
 
+// TestSetEnabledClearsPendingRuns verifies that disabling a job drops any
+// "queue" overlap backlog it was carrying, so re-enabling it later does not
+// replay a deferred run for an occurrence that fired before the disable.
+func TestSetEnabledClearsPendingRuns(t *testing.T) {
+	svc := newTempService(t, []domain.Job{{ID: 1, Name: "A", Schedule: "@every 1m", Command: "echo", Enabled: true}})
+	svc.mu.Lock()
+	svc.runtimes[1].PendingRuns = 2
+	svc.mu.Unlock()
+
+	if err := svc.SetEnabled(1, false); err != nil {
+		t.Fatalf("SetEnabled false: %v", err)
+	}
+	if rt := svc.Runtime(1); rt.PendingRuns != 0 {
+		t.Errorf("PendingRuns after disable = %d, want 0", rt.PendingRuns)
+	}
+}
+
 func TestSetGlobalPauseUpdatesRuntimesAndEmits(t *testing.T) {
 	svc := newTempService(t, []domain.Job{
 		{ID: 1, Name: "On", Schedule: "@every 1m", Command: "echo", Enabled: true},