fix(cron): support older systemd transient scopes

[paconejo2026]

Summary

• retry the restart-safe systemd-run --user --scope probe without OOMPolicy when older systemd rejects that property
• keep MemoryAccounting and finite MemoryMax isolation intact
• reuse the negotiated scope arguments for real cron workers

Verification

• scripts/run_tests.sh tests/cron/
• 1,198 passed, 20 skipped, 0 failed
• live gateway E2E created hermes-worker-cron-71f757b3ee75-exec-a85e8224ea904da9b56695117ee9719b.scope with MemoryMax=4061308928

[alt-glitch]

This was generated by AI during triage.

Duplicate of #102508 — same mechanism: re-run the systemd-run --user --scope probe without OOMPolicy=kill when systemd rejects it, then reuse the negotiated property set for real cron worker spawns. #102508 also keys each probe attempt to a distinct unit name and avoids negotiating on a missing user bus. Alternate approaches for the same bug (#102486/#103693): #102357 (drop the property), #103768 (version-gate). Maintainers should pick one.

[kshitijk4poor]

Thanks @paconejo2026 — the live E2E showing a hermes-worker-cron-…-exec-….scope with a real MemoryMax after negotiation is good evidence that dropping OOMPolicy loses nothing in isolation.

Closing in favour of #102357 (@gkd2323c, earliest for #102486). The cluster has converged on removing OOMPolicy=kill from the scope argv outright: field reports across systemd 239/245/249 show transient scopes reject it on every version users actually run, so the probe-then-retry-without-it negotiation in this PR (and in #102508 / #102655 / #103768) is machinery to discover an answer that is already known. Once the property is gone there is nothing left to negotiate. Same file and functions, so only one of these can be salvaged; #102357 is the minimal one. Will reopen if #102357 does not land.