Phase 4: a runners page, built from the queue's own presence

Phase 4: a runners page, built from the queue's own presence

"Nobody is connected and eleven jobs are waiting" is the sentence somebody needs when
a build does not start, and until now nothing could say it: a runner existed only as
an SSH channel, invisible to both the web and the queue. `runs.db` could already
answer "who holds this lease" (lease_owner, lease_until) and "who ran this" (the
attestation), but not "who is connected and idle".

Presence is now a row per channel in the queue — `runner_sessions` — written by events
a runner already sends: connect, lease (which records the run it holds), heartbeat (a
long build must not look gone), and finish (which clears it). A clean disconnect drops
the row, and `watchLeases` forgets rows silent for ten minutes, which is the only trace
a killed process leaves. Nothing here is authoritative: presence is a derived fact
about a live channel, which is why the page applies its own two-minute window rather
than trusting a stored "online" flag.

GET /runners shows the connected runners (account, the job it is building and its
repository, or "waiting for work") and the queue depth per repository. It follows the
clone rule like every other page: a session building a private repository is not shown
at all, and a private repository's queue is not counted, because naming either would
confirm the repository exists. The header now links to it from every page.

Measured: TestARunnerSessionIsVisibleWhileItIsConnected (a connected runner is one row,
idle, then "building <run>" once it leases), TestRunnersPageShowsTheRunnerHoldingAJob
AndTheQueueDepth (the page names the account, links the run it is building and counts
one waiting and one running), TestRunnersPageKeepsAPrivateRepositoryOut (no repository
name, account, job or run id from a private repository appears).