Filter hacked submissions from leaderboard queries

[SinatrasC]

Summary

• Exclude submissions marked hacked from leaderboard rankings and leaderboard submission counts.
• Check both leaderboard.submission.status and leaderboard.submission_job_status.status so queued/background hacked markings are filtered too.
• Add a regression test covering submission-status hacked rows, job-status hacked rows, and a clean visible row.

Why

• Retroactive KernelGuard marking should remove entries from ranking views without deleting submission/run evidence.
• Background jobs can record submission_job_status.status = hacked, while direct marking also updates submission.status.

Validation

• RUFF_CACHE_DIR=/tmp/kernelbot-ruff-cache uv run --with ruff ruff check . --exclude examples/ --line-length 120
• uv run --extra dev pytest tests/test_leaderboard_db.py -q
• uv run python -m py_compile src/libkernelbot/leaderboard_db.py tests/test_leaderboard_db.py