fix(cron): alert on restart-safe worker dispatch failures (salvage #123432)

[kshitijk4poor]

A failed handoff to the restart-safe cron worker now opens a cron_incidents row and sends the job's failure notice, instead of failing silently. Fixes #123401. This salvages #123432 by @liuhao1024.

Why

When the external-worker handoff failed, run_one_job() (cron/scheduler.py) recorded the failure on the job and in executions.db, then returned before any operator-facing path ran. There was no incident and no notice. In #123401, a 9.5-hour outage produced 106 failed executions and zero notifications, including for jobs whose only purpose is alerting.

Changes

• Incident and notice (@liuhao1024, fix(cron): surface external-worker dispatch failures through the incident path #123432): the dispatch-failure branch now goes through the existing _deliver_crash_failure, the same path a crashed run uses. That covers incident dedup, cooldown and the delivery outcome in the ledger.
• Bookkeeping always closes: the call sits inside the existing try/finally, so finish_execution still runs if delivery raises. There's no new try/except swallowing. This is defensive and not pinned by a test (the stack keeps to two tests); the probe covers it.
• No false alert after the handoff: once the worker has spawned and acknowledged the job, a later wait failure only updates bookkeeping. It opens no "dispatch failed" incident and sends no ping, because the worker may have run the job. Its last_error reads failed after handoff. A pre-handoff failure keeps the existing dispatch failed text.

Validation

probe (isolated HOME)	main	this PR
handoff fails before ack	incidents 0, notices 0	incidents 1, notices 1, exec failed/delivered
handoff succeeds	0 new	0 new
failure notice send fails (502)	nothing recorded	incident detected, delivery_error recorded
failure after the worker acked	n/a	0 incidents, 0 notices, bookkeeping recorded

• Tests: tests/cron/test_restart_safe_worker.py + tests/cron/test_run_one_job.py pass on the rebased head.
• Two invariant tests. Each fails with its production change reverted:
  • dispatch failure opens an incident and delivers the notice
  • a post-handoff failure is bookkeeping-only, with the new label

Known limit

The alert is not gated on the fire-claim owner. A non-owner that lost the claim can still alert on a pre-handoff failure. The triage rated this low severity, and it is left for a follow-up.

Credit

• @liuhao1024: the fix and its incident/cooldown test (fix(cron): surface external-worker dispatch failures through the incident path #123432), authorship kept.
• @webtecnica: the same fix in fix(cron): record incident and deliver notice on external worker dispatch failure (#123401) #123433, credited as co-author.