fix(web): sort Executions by run id/attempt, not started timestamp

Sorting by started_at let a manually re-run old workflow jump above a
genuinely newer run: the re-run's started_at bumps to now, but its run
number never changes, so the Run column stopped reading strictly
descending. run_id is assigned once at creation and never changes across
attempts, so (run_id, attempt) descending is both correct and simpler --
it also handles a queued run (no started_at yet) for free, no datetime.max
special case needed.

tests/python/test_operations_executions.py

@@ -432,6 +432,28 @@ def test_queued_run_sorts_above_started_runs(
     assert [r.status for r in view.runs] == ["queued", "success"]
 
 
+def test_a_rerun_does_not_jump_above_a_newer_run(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Re-running an old workflow bumps its ``started_at`` to now, but its
+    run id/number never change -- sorting by wall-clock time would put that
+    stale run above a genuinely newer one it should still trail. The Run
+    column must read strictly by run, descending, not by whichever attempt
+    was most recently kicked off."""
+    payload = [
+        _run(run_id=12, number=12, attempt=1, started="2026-07-25T10:00:00Z"),
+        _run(run_id=13, number=13, attempt=1, started="2026-07-25T10:05:00Z"),
+        # #12 gets manually re-run after #13 already started -- its
+        # started_at is now the latest timestamp of the three.
+        _run(run_id=12, number=12, attempt=2, started="2026-07-25T10:10:00Z"),
+    ]
+    _install_urlopen(monkeypatch, _admin_ok(payload))
+
+    view = list_executions(_make_config(tmp_path), [], token="tok", now=_NOW)
+
+    assert [(r.number, r.attempt) for r in view.runs] == [(13, 1), (12, 2), (12, 1)]
+
+
 def test_same_timestamp_falls_back_to_run_id(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None: