A test pins the held card: a private repository's row of why issues wait is drawn for its owner only #6857

src/web/pages/boards-held.ts says a private repository is in the rows for the owner only; heldCard has no test.

Done:

• [ ] test/boards-held.test.ts: with a public and a private autonomous repository, the flow panel drawn for the private one's owner has both rows; for another admin of the forge who cannot read it, only the public row; the private name appears nowhere in their HTML.
• [ ] Each row's counts match flow/held.ts's for the seeded holds, and a repository name with markup is escaped.

Files: a test only.

Before pushing: bun x tsc --noEmit and the tests you add or touch; bun scripts/design-lint.ts if src/web/ changes. Small and single-purpose; tests never read the wall clock — pass now in.