A repository's runs page filters by state: `?state=failed` lists only failed runs, under a row of state links #6477

When something broke, the owner wants the failed runs at once, without scrolling past a day of green ones.

Done:

• [ ] /:owner/:name/runs?state=<s> accepts only the run states the page already shows. Any other value is ignored, and the page shows every run, as it does today.
• [ ] A row of plain links above the list, All · Failed · Running · Succeeded (or the page's own state words), marks the current one with aria-current. Each one keeps the reader on this page.
• [ ] Visibility is unchanged: an outsider to a private repository still gets the one 404.
• [ ] test/runs-state-filter.test.ts seeds a failed and a succeeded run. ?state=failed lists only the failed one, ?state=bogus lists both, and the current link is marked.
• [ ] bun scripts/design-lint.ts passes.

Files: src/web/pages/runs.ts, test/runs-state-filter.test.ts