review classifier: keep stored runs this build can't decode

A run record this build couldn't decode was dropped from the list it
read, and the next recorded run wrote the list back without it, so a
rollback followed by a roll-forward lost the newer build's runs for
good. The stored list is now a list of entries, each a decoded run or
the raw JSON of one that didn't decode. The route still shows only the
decoded runs. An undecodable entry keeps its place, counts toward the
100, and is written back as it was read. A read that finds any logs one
WARN with their count and the first error.

The settings decode derived its known fields from what
`Settings::default()` serializes, so a later field skipped when unset
would have been stripped from a valid stored document and lost on the
next PUT. The known fields are now an explicit list. A test serializes
a fully populated `Settings`, checks that its keys match the list, and
checks that `decode` round-trips it.

docs/swarm/review-classifier.md

@@ -391,9 +391,9 @@ controller reads or writes. The controller creates the bucket on first use and
 adds each run with a compare-and-set write, so the list survives a controller
 restart or a move to another host. Recording the 101st run drops the oldest;
 there's no time-based retention. The controller leaves a run it can't decode, such
-as one a newer build recorded, out of the list with a warning in its log, and
-the next recorded run writes the list back without it; a document that isn't a
-list reads as no runs. The controller logs a failed write, and it
+as one a newer build recorded, out of the list with a warning in its log. It
+keeps the run in the store as it was and counts it toward the 100. A document
+that isn't a list reads as no runs. The controller logs a failed write, and it
 changes nothing on the forge.
 
 `GET /api/review-classifier/runs` returns the list, newest first. Like the