fix(disk-cleanup): protect cron output root from cleanup (salvage #49271)

[kshitijk4poor]

Summary

Salvage of #49271 by @martinramos002-bot (rebased onto current main). Stops the disk-cleanup plugin from deleting the cron output root (~/.hermes/cron/output) while still letting individual run artifacts below it be cleaned by retention policy.

The bug

The disk-cleanup plugin classifies anything under cron/output/ as disposable cron-output. That includes the cron/output root directory itself — deleting it wholesale erases every job's retained run history at once, far broader than expiring one run artifact.

The fix

• Add str(base / "output") to _PROTECTED_CRON_PATHS in _is_protected_cron_path (for both cron and cronjobs parents) — a hard block on deleting the output root.
• In guess_category, tighten the gate from len(rel.parts) >= 2 to >= 3: rel is relative to hermes_home, so cron/output is ('cron','output') (len 2) → no longer categorized deletable, while a real artifact at cron/output/<file> (len 3) or deeper stays cron-output and is still cleaned.

Two independent defenses for the same invariant (root not deletable): the category gate, and the protected-paths hard block as defense-in-depth.

Verification

Verified against current main (applied + behaviorally probed): cron/output root → protected; cron/output/run.md (len 3 file), cron/output/job_1/run.md (len 4), cron/output/job_1 (len 3 dir) all still deleted; a stale tracked.json entry pointing at the root is dropped by quick()'s re-validation and hard-blocked by _is_protected_cron_path (both canonicalize via .resolve()). No off-by-one, no over-broad protection, no residual deletion path.

Ran hermes-agent-dev + hermes-pr-review Phase 2c (4-part structured) on the final salvage.

Tests

tests/plugins/test_disk_cleanup_plugin.py — output-root-not-tracked, stale-entry-for-output-root-not-deleted, plus existing artifact-still-cleaned coverage. (CI runs the full suite.)

Supersedes #49271. Full credit to @martinramos002-bot.

[kshitijk4poor]

Ran hermes-agent-dev + hermes-pr-review Phase 2c (4-part structured). 0 Critical, 0 Warnings. The off-by-one gate is correct (root protected, artifacts still cleaned), the two defenses (category gate + protected-paths set) are legitimate defense-in-depth (gate stops new tracking; set stops deletion of stale tracked.json entries), both .resolve()-consistent, both cron/cronjobs parents covered. Folded one doc-clarity follow-up (9ddd7c8): spell out that the output-root protection is exact-match-only so a future editor can't 'simplify' it into a blanket cron/output/* guard.

[alt-glitch]

This was generated by AI during triage.

Salvage of #49271 (rebased onto current main). related_to the disk-cleanup cron-protection cluster (#39067, merged stale-entry revalidation). Not a duplicate; this is the output-root-protection facet.