fix(cron): reject past one-shot in update_job fallback + resume_job (#59395)

[kshitijk4poor]

Summary

Completes the #59395 bug-class fix by closing the two remaining doors that could persist a one-shot cron job with next_run_at=None (a "ghost job" that looks healthy in cronjob list but never fires). Salvages the additive parts of #59428.

Background

create_job() and update_job()'s schedule-change path already reject past one-shots (landed via #59410 → #59438). Two entry points were still unguarded:

1. update_job fallback-recompute — the safety-net that re-derives next_run_at when it's missing on an enabled, non-paused job.
2. resume_job — resuming a paused one-shot whose run_at has already passed. Empirically confirmed on current main: this produces state="scheduled", enabled=True, next_run_at=None — the exact ghost job, through a door fix(cron): reject one-shot jobs with a past timestamp at create + update (#59395) #59438 didn't close.

Both now raise ValueError when compute_next_run() returns None and kind == "once".

Changes

• cron/jobs.py — guard the update_job fallback-recompute path and resume_job (raise before any disk write / before delegating to update_job, so no partial state).
• tests/cron/test_jobs.py — resume_job on a paused past one-shot raises (recreates the confirmed ghost scenario); update-to-past raises; update-to-future / within-grace still accepted.
• scripts/release.py — AUTHOR_MAP entry for @isheng-eqi (bare email, doesn't auto-resolve; check-attribution requires it).

The redundant update_job schedule-change hunk from the original #59428 was dropped — it's already on main via #59438.

Validation

	Before (main, post-#59438)	After
resume paused past one-shot	ghost job (scheduled, next_run_at=None, never fires)	ValueError, not revived
update fallback recompute → past one-shot	stored None silently	ValueError
resume/update future one-shot	works	works (unchanged)
one-shot post-fire lifecycle	auto-deleted	auto-deleted (unaffected)
tests/cron/ full suite	—	638 passed, 0 failed

ruff clean, ty 3==3 (zero net-new).

Credit

Salvaged from #59428 by @isheng-eqi — cherry-picked to preserve authorship (additive guards + tests), redundant schedule-change hunk dropped. This is the third and final PR in the #59395 cron-ghost-job cluster (create → update-schedule → update-fallback + resume). Closes #59428.

[alt-glitch]

This was generated by AI during triage.

Salvage/superset of open #59428 (same two call sites: update_job fallback-recompute + resume_job); the redundant update_job schedule-change hunk was dropped as it already shipped via merged #59438. Related, not a duplicate. Completes the #59395 bug-class fix.