web: design follow-ups from the v1.23.0 final review #221

Small items the whole-branch review of #218 left for later:

• without a control on the overview's clone captions (SSH, HTTPS) and the settings Visibility row; use a span or heading for captions and keep label for controls. e2e/design_test.go pins the current markup.
• Settings checkboxes have no text to their right; the label sits in the grid's first column. Decide whether the spec's "label to its right" applies inside the row grid.
• edit.html is bounded; a code textarea fits wide better.
• runner-add is the one settings write with no "Saved the …" flash, and a failed attach drops the pasted key.
• No test asserts the repository header is identical within a tab; compare the header block of /issues and /issues/1.
• landingPicture is always true (go:embed fails to compile without the PNGs); the {{if .Picture}} guard is unreachable-false. Drop the var or make the images optional.
• button.primary restates the base button ground and colour.
• The MR aside's "Source and target" line showed a trailing separator on the deployed 185f434 page in a capture; not reproduced from the template. Re-check after the next deploy.

Ref #218