Let a person recover an agent's set whose check job ended after the agent lost its key #2660

Part of #2422 (F-DSK). Found by the independent review of #2658. This is existing v2 behaviour.

When an agent's set is in checks running and its check job ended without moving it, only that agent can recover it, by submitting again. If the agent's key has been revoked or has expired, nobody can: the set view offers no recovery to a person for an agent's set, and Reject isn't offered while the checks are running. The set stays in checks running for good. Core would let any person recover it (ChangeSetChecks.MaySubmit).

Scope

• The set view offers "Run the checks again" to a person on an agent's set whose check job ended, when the agent's credential is revoked or expired.
• Tests: a revoked agent's set with a dead job is recovered by a person. A live agent's set offers it to no person.

Acceptance

• No set stays in checks running after its job ended and its agent can no longer act.