Hide submissions with failed secret runs

[msaroufim]

Summary

• Hide public scored runs when the same submission has a failed secret run for the same runner and mode.
• Apply the filter to leaderboard rankings, personal leaderboard listings, submission counts, and authenticated user submission score summaries.
• Add local DB regressions for public-pass plus secret-fail submissions.

Validation

• uv run --extra dev pytest -q tests/test_leaderboard_db.py -k 'failed_secret_run or leaderboard_submission_ranked or leaderboard_submission_count'
• uv run --extra dev pytest -q tests/test_leaderboard_db.py
• uv run --extra dev python -m py_compile src/libkernelbot/leaderboard_db.py
• git diff --check

Notes

• This only changes visibility/filtering. It does not delete rows or mutate production data.
• I did not run any production admin update/backfill command.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
src/libkernelbot
leaderboard_db.py
utils.py
Project Total

This report was generated by python-coverage-comment-action