fix(cron): resolve relative script paths relative to job workdir instead of cwd (#59599)

[webtecnica]

Resolve relative cron script paths relative to job workdir instead of cwd. All 3 _run_job_script call sites now pass base_dir from job's workdir. Closes #59599

[teknium1]

Thanks for tackling cron script-path handling. The current patch needs rework before it can provide the stated behavior.

Problems

• The new base_dir resolution still flows into the existing scripts_dir containment check at cron/scheduler.py:2059. Therefore a script under a job workdir outside HERMES_HOME/scripts remains blocked; the new branch does not enable the advertised ./scripts/foo.sh case.
• Current main executes scripts through _run_job_script_with_claim_heartbeat (cron/scheduler.py:2611, 2758), whose internal calls at 2162, 2193, and 2196 do not pass a base directory. The PR's older direct-call edits do not cover those paths.
• #59599 asks to accept absolute/home-relative paths already under ~/.hermes/scripts, but tools/cronjob_tools.py:546-550 rejects those values before the scheduler runs. This PR does not touch that boundary.

Suggested changes

• Decide whether the intended scope is #59599's scripts-directory normalization or a broader workdir execution policy; the latter must preserve the containment guarantees introduced by 878b1d3d3.
• Carry any approved resolution context through the heartbeat wrapper and add agent/no-agent regression coverage.

Automated hermes-sweeper review.

[teknium1]

This resolution is immediately rejected by the unchanged path.relative_to(scripts_dir_resolved) guard below whenever base_dir is outside HERMES_HOME/scripts. Thus the advertised job-workdir-relative path still cannot run; the resolution and containment policy need to be designed together.