Hide submissions with any failed secret run

[msaroufim]

Summary

• hide public leaderboard scores when the same submission has any failed secret run for that runner
• add a regression for the QR failure mode: public leaderboard passes, secret benchmark fails

Why

PR #490 only filtered failed secret runs with the same mode as the public scored run. QR submissions can fail secret benchmark before producing a secret leaderboard run, while still having a passing public leaderboard score. Those should not appear on rankings.

Validation

• uv run --extra dev pytest -q tests/test_leaderboard_db.py -k 'failed_secret or leaderboard_submission_ranked or leaderboard_submission_count'
• uv run --extra dev python -m py_compile src/libkernelbot/leaderboard_db.py
• git diff --check
• verified the updated SQL excludes prod submissions 800895, 800582, and 800601

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
src/libkernelbot
utils.py
Project Total

This report was generated by python-coverage-comment-action