ct-runner runSuite: only should report deselected rows and let capability win over selection (polymorph-test #89 policy) #286

With #260 making runSuite() the only public ct-runner case loop, polymorph-test moved its browser shard worker onto it (polymorph-test#106). That surfaced one policy gap between runSuite and the JS/Rust reference runners it mirrors.

polymorph-test's docs/runner-policy.md §"Selection is not capability" (polymorph-test#89): under only, the unselected remainder of the census is reported as deselected rows (never executed, no provenance) so subset runs still fold and aggregate with the subsetting visible, and capability takes precedence — a tags-excluded case is reported not-applicable even when it also falls outside the selection. The reference runner, js/viewer/harness.mjs's runCases, and crates/component-test-runner all do this (runner.rs::only_reports_the_rest_of_the_census_deselected).

runSuite (run-suite.ts) applies only first with continue and no emit, before the tag-gating block. Observable on polymorph-test's fixture suite with missing: ["hsm"], only: "gen":

• reference runners: 8 rows — 2 pass, 1 not-applicable (fixture/hsm/attest), 5 deselected; counts na: 1, deselected: 5, selected: 2
• runSuite: 2 rows; fixture/hsm/attest vanishes; RunCounts has no deselected/selected (polymorph-test#106 derives selected = passed+failed+skipped+na in the worker for page-runner's empty-selection check)

The comment in run-suite.ts cites harness.mjs's ordering ("only first, then drift, then applicability") but harness.mjs emits a deselected row at that point rather than skipping. Suggested: emit {case, status: "deselected", detail: "only <filter>"} for filtered-out cases (after tag gating decides not-applicable, per the precedence rule), and add deselected to RunCounts. polymorph-test#106's selftest asserts the current runSuite behavior and would flip back when this lands. Not blocking anything.