fix(kanban): reject direct running transitions in dashboard bulk updates

[kronexoi]

Summary

Align the dashboard bulk update endpoint with the single-task PATCH behavior by rejecting direct transitions to running.

The kanban lifecycle requires tasks to enter running only through the dispatcher/claim path, which creates the run row and claim metadata atomically. Before this change, /tasks/bulk still allowed status="running", which could strand tasks in a fake running state without proper run/claim bookkeeping.

Changes

• Reject status="running" in POST /api/plugins/kanban/tasks/bulk
• Keep per-item bulk semantics: the affected item returns ok=false with a clear error
• Add a regression test covering the bulk rejection path

Why

Single-task dashboard PATCH already rejects direct running transitions. Bulk updates had drifted from that invariant and could bypass the dispatcher lifecycle.

Testing

Passed:

• test_patch_status_running_rejected
• test_bulk_status_ready
• test_bulk_status_done_forwards_completion_summary
• test_bulk_status_running_rejected
• test_bulk_archive
• test_bulk_reassign
• test_bulk_unassign_via_empty_string
• test_bulk_partial_failure_doesnt_abort_siblings
• test_bulk_empty_ids_400