Bounded paging and filtering over one frozen private run-catalog generation.

The query receives rows already detached and classified by PtcRunner.Kernel.RunCatalogSnapshot. It never lists a root, opens an artifact, or reads evidence. Cursors bind both that generation's digest and the complete filter query; limit remains a page-size choice and may change between pages.