A highlighting test allows a debug build more time 8eae2f0e255c

## Unreleased

- **`oh runner-updates` and its API (#322):** site administrators read every level's update settings, the test groups, each runner's policy and offer, and the held builds (`GET /api/v1/admin/runner-updates`); `oh runner-updates set group:canary --updates on --window 02-05` changes one level, keeping what is not given (`PUT …/settings`, 422 saying what is wrong); `oh runner-updates lift 0.4.0` offers a held build again (`POST …/holds/{version}/lift`).

- **A build that rolls back on one runner is held for the rest (#326):** when a runner reports it rolled back from flow X (it did not reach the hub after updating, or would not start), the hub offers X to no other runner, saying why, until an administrator lifts the hold on Admin › Runners › Updates, which lists each held build with the runner and the reason. One failed canary halts the rollout. Migration 0097.

- **Finished work moves to Done (#325):** a card whose issue closes (on its page, through the API, or by a change's `closes #N`), or whose proposal lands or closes, moves to its board's column for finished work. A new board's Done is that column, and so is each existing board's column named Done; a column's menu turns it on or off (one column of a board). Archived cards stay archived.

        let long = format!("var a=\"<\";{}\nb();\n", "x+".repeat(MAX_HIGHLIGHTED_LINE));

        let started = std::time::Instant::now();

        let l = lines("app.min.js", &long);

        assert_eq!(l.len(), 2);

        assert!(l[0].starts_with("var a=&quot;&lt;&quot;;") && !l[0].contains("<span"), "{}", &l[0][..40]);

        assert!(lines("app.js", "var a = 1;\n")[0].contains("<span"), "a normal file is highlighted");