Two calls and not one, on purpose. GET /runs is the one place run filtering lives, so
the page comes from there — it grew a trigger_ref filter and nothing else; what this
handler adds is the 404. Without it, a schedule id from another tenant would answer with
an empty page, and “this schedule has never fired” is a very different sentence from “this
schedule is not yours”.