Orphaned PENDING_REVIEW runs from closed PRs block VCS settings changes with no UI path to resolve

Context: We have stacks configured to require approval on PROPOSED runs (used as a GitHub status check to block PR merge until someone reviews the plan in Spacelift). When we tried to update the Repository config on those stacks, it failed with all runs need to finish before changing the VCS settings. We discarded/rejected everything visible in the PR view, but the error persisted. Using spacectl against the GraphQL API, we found hundreds of runs stuck in PENDING_REVIEW from PRs that had since closed. After bulk-discarding those via the API, the settings change went through.

Repro:

1. Stack with an approval policy requiring approval on PROPOSED runs

2. Open a PR — PROPOSED run created in PENDING_REVIEW

3. Close the PR without ever approving/rejecting the run

4. Run stays in PENDING_REVIEW indefinitely, invisible in the stack's PR view

5. Try to change the Repository setting — blocked by all runs need to finish before changing the VCS settings, with no way in the UI to find the offending runs

The FR (two possible angles, not mutually exclusive):

• Surface PENDING_REVIEW runs in the stack UI, especially ones orphaned by closed PRs. Today they're invisible once the PR is gone.

• List the blocking runs in the error message when a VCS settings change is rejected, so users can act on it without dropping to the API.

Behavior is technically correct (PENDING_REVIEW is legitimately "not finished"), but the visibility gap makes it undiagnosable from the console. We're unblocked for now — logging this for awareness.