/sitemap.xml gives each repository a lastmod from its last push, and a suspended account's repositories never appear #5694

Split from #4109. Its second try (pull #5689) went red on a suspended account's repositories leave every list, so this piece keeps that promise explicitly.

Done:

• [ ] sitemapRepos (src/core/listings.ts) returns each repository's last push time beside its owner/name, still through listReposVisibleTo(db, undefined, { withoutArchived: true }), which already hides private, archived and suspended repositories. It stays held in the same Fresh holder and forgotten by forgetListings. llmsRepos keeps returning names only.
• [ ] sitemapXml writes <lastmod> as a W3C date (YYYY-MM-DD) for each repository with a push. One with no push gets no lastmod.
• [ ] Tests (a new test/sitemap-lastmod.test.ts): a pushed public repository has its lastmod; a never-pushed one has none; after its owner is suspended, the next /sitemap.xml no longer lists it. Each fails without the change.
• [ ] Before pushing, run the new test, test/suspended-hidden.test.ts, test/sitemap-timing.test.ts and bun x tsc --noEmit. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/core/listings.ts, src/web/standards.ts (sitemapXml only), test/sitemap-lastmod.test.ts. Risk: #5376 times llmsTxt in the same file; touch only sitemapXml.

Parked by the crew: the check failed ("RepoSource: one repository, two places to read it from > a mirror reports its stages in order and ends holding the repo") and the decider saw no point in another try (pull #5724 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.