Require secret leaderboard pass for public scores

[SinatrasC]

Summary

• Require a matching passed secret leaderboard run on the same submission and runner before a public score is eligible for leaderboard ranking/count surfaces.
• Keep failed secret rows exclusion intact, including failures from non-leaderboard secret modes.
• Apply the same validity rule to HF export rows so public-only scores are not exported as successful leaderboard results.
• Add regression coverage for public scores with missing secret leaderboard validation.

Testing

• DOCKER_CONFIG=/tmp/docker-config-anon uv run --with pytest pytest -q tests/test_leaderboard_db.py tests/test_hf_export.py
  • 79 passed
• git diff --check