Fix confirmed-delivery wake loss across session restart

[bradbrok]

Closes #949.

What changed

• Persist unconfirmed scheduler wakes in a durable outbox and replay them FIFO into the agent's next booted/oriented session.
• Capture an immutable fired_at on each queued cohort member so overlapping fires of one schedule retain distinct durable identities.
• Extend the exact receipt window only while the inflight watchdog's own fresh busy-not-wedged verdict remains positive.
• Route every newly observed FIRED BUT UNDELIVERED event to the canonical Channel-approval gate silently eats steady-state group inbound after upgrade (no grandfathering + owner-notify failure) — onesie/TOD 2026-07-11 #863 owner-notify destinations.
• Retire deleted or operator-disabled recurring schedules loudly instead of delivering zombie wakes.
• Synchronize scheduler ticks on an explicit callback-start signal, preserving Nightly dream run blocks the scheduler tick loop for its full duration — cron schedules in the window are silently skipped (fleet-wide) #702's immediate-start contract without awaiting the callback's receipt or dream work.

Why

A long healthy turn could outlive the 600s scheduler receipt window. The resulting negative receipt was requeued into the same transport deque, which voluntary context_restart then canceled and discarded. Journald recorded the loss but no owner-facing channel surfaced it.

Behavior and boundaries

• Replay is lifecycle-gated: another cron fire in the old session cannot drain the persisted backlog.
• Catch-up is sequential behind orientation; older persisted wakes precede a simultaneously ready live cohort.
• Transient failure of the oldest row halts replay and leaves the whole FIFO for the next boundary; terminal zombie rows retire loudly and allow later live rows to advance.
• Auto-disabled one-shots remain replayable and retire atomically after one exact positive receipt.
• The callback-start synchronization is bounded and receipt-independent; an older per-agent delivery lock cannot make the scheduler tick wait indefinitely.
• Broader Scheduler fires are lost when a daemon restart lands near the fire: no atomic last_run persist, no startup catch-up (3 casualties on 06-11) #747 cron-window catch-up is intentionally out of scope.
• No deployment is performed from this lane. No live daemon SQLite was opened; all database checks use fixture files.

Verification

• Positive control on blocked head d473dbf9, Python 3.12.13: the strengthened Nightly dream run blocks the scheduler tick loop for its full duration — cron schedules in the window are silently skipped (fleet-wide) #702 regression failed before the production fix with fired == [], proving it detects the cross-version scheduling defect.
• Strengthened Nightly dream run blocks the scheduler tick loop for its full duration — cron schedules in the window are silently skipped (fleet-wide) #702 regression after the fix: 10/10 passes on each of Python 3.11.15, 3.12.13, and 3.13.14; it asserts the callback has started while its exact-receipt delivery task remains pending.
• Scheduler suite: 107/107 on each of Python 3.11, 3.12, and 3.13.
• Python 3.11 affected selection: 624 passed (registry, scheduler, daemon, focused API contracts, full tmux transport suite).
• Ruff, uv lock --check, compileall, and git diff --check passed.
• Explicit regressions cover overlapping exact-fire identity, busy-window extension, canceled deque persistence, next-session-only replay, FIFO ordering and transient halt, zombie-head retirement with live FIFO advance, owner alert routing, and one-shot exactly-once replay across a fixture restart.

[olegbrok]

Verify-lane criterion for the replacement packet (recording here since it's the surface both lanes re-read; also sent to Kuzya directly):

"Stop replay at first oldest failure" must distinguish two cases or the outbox gains a new single point of loss:

• TRANSIENT failure of the oldest row (delivery attempt failed, session busy/dying): halt FIFO, retry at the next lifecycle boundary. No overtake — per Murzik's strict-FIFO finding.
• TERMINAL verdict on the oldest row (schedule deleted/operator-disabled → PERSISTED_WAKE_ZOMBIE_DROPPED): retire the row loudly and let FIFO advance. A poisoned head row must not wedge every wake queued behind it.

Required regression if not already present: zombie at head of queue + live pending rows behind it → zombie dropped with the literal, live rows deliver in order.

Also concur with treating the post-freeze CodeQL inline finding as unwaived — adjudicate it on the replacement SHA where it re-runs.

🤖 Opened by Barsik