feat(cron): harden scheduled execution accountability

[brianrogstad]

Summary

• add a durable execution ledger for scheduled producer and delivery runs
• bind builtin and Chronos invocations to one canonical nominal-fire identity
• preserve exact producer/delivery lineage, requested and actual targets, immutable media hashes, and provider receipt evidence
• fail closed on ambiguous post-contact outcomes so retries cannot duplicate external delivery
• carry the execution contract through gateway adapters, standalone senders, dashboard fire handling, and Chronos

Safety properties

• scheduler claims are replay-safe and occurrence-bound
• delivery runs point to their exact producer execution
• copied media is execution-owned and revalidated before dispatch
• requested target order and terminal receipt order must agree
• post-contact transport failures remain ambiguous rather than falling back to a duplicate send
• completed/failed execution evidence remains durable across restart and recovery

Test plan

• pytest -q tests/cron — 606 passed
• gateway/tools/Chronos changed surface — 118 passed
• current upstream main rebased cleanly
• independent immutable review found no MEDIUM+ defects

[ItaiWeiser]

Two narrow contract questions remain at the delivery boundary.

First, SendResult should distinguish explicit adapter evidence that send/contact may have started from positive evidence that no send began. These are not inferred opposites: a timeout or cancellation after dispatch can be send_started=true with confirmation unknown, and Future.cancel() success alone is not definitive_no_send. Automatic retry or fallback should require explicit definitive-no-send (or equivalent safe-retry) evidence; adapters that cannot know should fail closed rather than synthesize certainty.

Second, if cross-execution semantic deduplication is added, which existing durable boundary owns the transaction: this PR's Cron delivery ledger or the journal/outbox in #81554? Please select one owner for the semantic claim and every receipt transition. Splitting claim and terminal evidence across both would reintroduce ambiguity; this is not a proposal for another store.

Acceptance should cover pre-contact failure as retry-safe, post-contact timeout as unknown/no resend, cancellation not manufacturing certainty, and fault injection proving a claim cannot commit in one durable boundary while its terminal evidence commits in another.