RunStatus is serialised as a bare string, so no client can check its values

`RunStatus` crosses the wire as a bare string rather than as a named enum, so no client can check it against the server.

Read from the OpenAPI document served by `ghcr.io/baryodev/barako-cms:master` with `Swagger__Enabled=true`:

```json
BarakoCMSFeaturesWorkflowRunsRunResponse.status -> { "type": "string" }
BarakoCMSFeaturesWorkflowRunsAttemptResponse.status -> { "type": "string" }
```

Five other enums in the same document do it properly:

```
BarakoCMSModelsContentStatus = [Draft, Published, Archived, Scheduled]
BarakoCMSModelsFieldMask = [Default, Remove, Redact, Last4]
BarakoCMSModelsMembershipStatus = [Active, Suspended, Removed]
BarakoCMSModelsSensitivityLevel = [Public, Sensitive, Hidden]
BarakoCMSAccountingDomainAccountType = [Asset, Liability, Equity, Income, Expense]
```

So this is not a missing capability, it is one response model typing a status as `string`.

## Why it matters to a client

BaryoDev/barakoBrew#1 is about a guarantee the console lost in the split: a test used to read `RunStatus` out of this repository's C# in a sibling checkout and assert the console's list matched, name for name, in order. The split moved the file and the test was deleted, because a skipped gate is a gate that never fails.

The replacement reads this document instead, which is better: it checks the published contract rather than the source. It now covers `ContentStatus`, `SensitivityLevel` and `FieldMask` in BaryoDev/barakoBrew#71. `RunStatus` cannot join them, because there is nothing published to compare against.

The console offers a run-status filter built from its own transcribed list. A status added or dropped here is silent: the filter keeps offering something the server no longer returns, or stops offering something it does, and both look like working software.

That is not hypothetical for this pair of repositories. `ContentStatus` was numeric on both sides, transcribed by hand, and `Draft` was `0`. Zero is falsy, so every truthiness check written against it meant the opposite after the switch to strings, and nothing failed. The same shape turned up again this week in `FieldMask`, which the console had declared numeric while this API published names.

## What would fix it

Type the property as the enum in both response models, the way the five above already are, so it appears in `components.schemas` with its values. No behaviour change on the wire if it already serialises names.

## Done when

- `RunStatus` appears in the OpenAPI document with its values.
- A client can read it without knowing anything about this repository's source layout.