Fix the screens the first subscription build walked through

[artyomsv]

Why

The first live subscription build (ticket spire-test #37) worked end to end: it paid with the seat, recorded 69,888 cached input, 4,103 input and 730 output tokens as unmetered, and cost 0. The operator's walk through the screens found seven rough edges. This PR fixes them.

What

1. Harness keys: Delete. A switched-off key or seat can be deleted. One no run used is removed. One a run used has its secret erased and leaves the screen; the row stays only so the run can still name what paid (V86: api_key nullable, erased_at, label unique among live rows only). A member still switched on is refused with harness_credential_still_on.
2. Build setup. The form says which fields keep it from saving ("To save, fill in: Base branch, Model."). Save used to stay disabled with no reason given.
3. Work items. A note says tickets arrive by a scheduled scan (every 30 s by default), so a new ticket can take a minute or two to appear. The repository has no ticket webhook today; the scan is the only intake for GitHub issues.
4. Approval panel. Shows Pays with, which the approval binds, and captions the two texts: "Specification — the ticket text" and "Plan — the one step the build runs".
5. Work item page. Reads the item again every 10 s while visible and no panel is open, like Runs.
6. Verify stop. verify_capability_unavailable now says verification is not built yet and the result is held: no push, no pull request.
7. Ticket source. Accounts show role and bot handle (public-github · github · Reviewer · @code-spire-mole). Two accounts shared the name public-github, so the reviewer account had been picked as the ticket source without it being visible. That is why the ticket comment came from mole. The setting itself is the operator's to change.

Checks

• Orchestrator suite passes; the targeted pool, sign-in, seat and resource suites pass.
• Full UI: 936 tests in 105 files; npm run build passes. One run saw ReviewDetail.archive fail once under load; it passes alone twice and in a full re-run, and this PR does not touch it.
• 15 production mutants, each caught by the intended test.