dashboard: split queued vs running rebuild visual (#769)

Container row's pending highlight fired for both queued + running
rebuild-queue entries, so a long queue painted half the SW4RM tab
amber. Mara on #769: don't highlight while queued, show running as
spinner on agent icon.

- tabs.js: derive opRunning (transient OR op.state === 'running')
  separately from pending; add a pending-running row class.
  Operator-initiated transients still count as running so the
  rebuild-now-clicked → backend-picks-it-up window stays visually
  consistent.
- dashboard.css: move the amber border + tint from .pending to
  .pending-running (queued rows now keep their normal look, with
  the badge text still saying "rebuild queued"). Add a 1s linear
  rotating amber arc as .pending-running > .container-icon::after,
  with overflow:visible so the ring sits just outside the icon and
  composes with the mauve selected ring.
- docs/web-ui.md::Container row: describe the queued vs running
  split in prose. Drop the orphaned (#398) cookie while I'm at it
  — small #712 freebie.

docs/web-ui.md

@@ -433,8 +433,14 @@ body sits to the right with three stacked lines
   entry for this agent is `queued` or `running` but no
   operator-initiated transient is set, the card surfaces a
   `building…` / `meta-updating…` badge sourced from
-  `rebuildQueueState` (#398) — so the SW4RM tab shows the same
+  `rebuildQueueState` — so the SW4RM tab shows the same
   rebuild progress visible on the SYST3M tab's R3BU1LD QU3U3.
+  The row visual splits queued vs running: a **queued** entry shows
+  only the pending-state pill (no row tint, so a long queue doesn't
+  paint half the tab amber); a **running** entry keeps the amber
+  row tint AND draws a **rotating amber ring** around the agent
+  icon, so it's obvious at a glance which container is actually
+  moving.
   Container name + port, and a `ctx · Nk` chip showing the
   agent's last-turn context size (from `ContainerView.ctx_tokens`,
   read from the turn-stats sqlite on each `build_all` sweep;