Config hooks and outbound webhooks fire for external-worker cron jobs (salvage #131831)

[kshitijk4poor]

Cron jobs run by the restart-safe external worker now fire the profile's config hooks: (shell hooks and hooks.outbound webhooks), the same as jobs run in-process.

Fixes #131764

What happened

The external cron worker (cron/scheduler.py::_run_external_worker_payload, added in #101940) discovered plugins (since 411c0405b6) but never registered config hooks, so hooks: and hooks.outbound silently did nothing for worker-run jobs while plugin hooks still fired — which hid the gap.

Change

• cron/scheduler.py::_run_external_worker_payload: after plugin discovery and inside the payload's home override and secret scope, call the gateway's own GatewayStartupMixin._register_config_hooks (the helper the gateway uses per profile at startup). Registration happens once per worker process; both registries are keyed per home and idempotent.
• tests/cron/test_external_worker_config_hooks.py (new): a multiplexed payload registers the owning profile's shell hook and a secret_env outbound webhook under that profile's home key.

Credit

@liuhao1024 (#131831, draft) — commit 7c3dc30b57 cherry-picked with authorship kept (-x d1971c698a). Our follow-up 018d9130a1 reuses the gateway helper instead of a copied registration sequence and moves registration inside the secret scope: in the original ordering, an outbound webhook with secret_env raised UnscopedSecretError on a multiplexed gateway and was silently dropped.

@drafie found the same gap first in #119421 (shell hooks only).

Verification

Live probe — real _run_external_worker_payload, 2 payloads per worker	on_session_start callbacks	outbound callbacks	hook fires
main (single-profile and multiplexed)	0	0	0
#131831 alone, multiplexed	1	0	2
this branch (single-profile and multiplexed)	1	1	2
profile without hooks: (neighbour), main and branch	0	0	—

• New test: red on main (shell hook not registered) and red with only the contributor commit (outbound webhook missing); green on the branch.
• 13 related test files (cron worker, outbound webhooks, shell hooks, gateway profile/hook scope, plugins, scheduler): 324 passed, 17 skipped.
• Import cost of the lazy gateway.run_startup import in the one-shot worker: 2–3 ms (does not import gateway.run).

Independent review: correctness, tests/probe/mutation, reuse, quality and efficiency passes approved.

Maintainer notes

• Cron calls a private static method on a gateway mixin. Kept deliberately for this fix; a later cleanup could move it to one public register_config_hooks() shared with cli.py and hermes_cli/main.py, which hand-write the same sequence.
• tui_gateway/server.py re-registers shell hooks per session but not outbound webhooks — separate, out of scope here.
• fix(cron): suppress bootstrap relaunch inside an adopted external worker #124847, fix(cron): stop an adopted external worker from re-exec'ing and losing its payload (#124827) #124855 and fix(cron): forward one-off prompts to external workers #128324 also touch _run_external_worker_payload.