Saving a domain already clears its queued certificate renewals before queuing a new one (#290), because each renewal queues the next and two would keep renewing for good. Creating an AcmeRenewal task, or a DNS task that renews the certificate after, through x:Task/set skipped that, so a client could start a second chain. It now clears them the same way, and refuses a second renewal for the same domain in one request. The test also covers telling a queued renewal to run now by setting its status to Pending, which the console's Order again uses (inbuxa-admin#167).