fix(cron): allow profile-local cron storage

[jeeves-assistant]

Summary

• Adds cron.storage_scope with default root to preserve existing root-wide cron behavior.
• Allows isolated profile gateways to opt into cron.storage_scope: profile so they read/write their own profiles/<name>/cron/jobs.json instead of competing for the default profile's cron store.
• Moves the tick lock next to the active cron store so root-wide and profile-local schedulers coordinate in the correct scope.

Why

Multiple resident profile gateways can otherwise all tick the default/root cron store. That makes isolated persona bots try to run default-profile jobs, miss their own profile-local jobs, and emit confusing delivery/auth failures.

Test Plan

• python -m py_compile cron/jobs.py cron/scheduler.py hermes_cli/config.py
• python -m pytest tests/cron/test_cron_profile_storage.py tests/cron/test_claim_job_for_fire.py -q -o 'addopts='
• python -m pytest tests/cron/test_cron_profile_storage.py tests/cron/test_claim_job_for_fire.py tests/cron/test_jobs.py -q -o 'addopts='
• python -m pytest tests/cron -q -o 'addopts='

[jeeves-assistant]

Closing as superseded by current main. The latest update includes #51116, which deliberately reverts the root-anchored cron store and returns cron job storage/lock paths to the active profile's HERMES_HOME. I verified current main resolves a profile HERMES_HOME to profile-local cron/jobs.json and .tick.lock, so this PR's opt-in cron.storage_scope approach is no longer needed and now conflicts with the chosen behavior.

[jeeves-assistant]

Superseded by #51116 on current main.