fix(cron): check binary magic bytes instead of bare NUL for lifecycle guard (#77927)

[RelaxJonh]

Summary

Fixes #77927. The b"\x00" in data check in _read_referenced_script() treated any file containing a NUL byte as a compiled binary and skipped scanning. But bash executes text scripts straight past embedded NULs, so a single pad byte lets a script bypass the lifecycle guard entirely.

Root Cause

The #76762 fix traded a loud failure (ValueError from Path.resolve on NUL bytes) for a silent one: the guard allows the command. The gap is between "contains a NUL" and "is a compiled binary" — those are different questions.

Fix

Replace the bare b"\x00" in data check with magic-byte detection via _is_known_binary_format():

• Known binary (ELF \x7fELF, Mach-O, PE MZ, Java class, WebAssembly): skip as before — binaries are not referenced shell scripts.
• Unknown format with NULs (text script with stray \x00): strip NULs from the data before decoding, so downstream Path.resolve and regex matching cannot raise ValueError.

Changes

• cron/lifecycle_guard.py: Add _is_known_binary_format() helper; update _read_referenced_script() to distinguish real binaries from NUL-padded text scripts.

Testing

# NUL-padded script is now scanned (not skipped)
echo -e '#!/bin/bash\n\x00hermes gateway restart' > /tmp/test.sh
# Before: returns None (skipped) — guard allows the command
# After: returns text with lifecycle command detected — guard blocks

# ELF binary is still correctly skipped
cp /usr/bin/ls /tmp/test.bin
# Returns None, False (correct — not a shell script)

[alt-glitch]

This was generated by AI during triage.

Duplicate of #77928 — both repair the lifecycle guard's NUL-padded text-script bypass by distinguishing actual binary magic from an embedded NUL.