fix(cron): catch RuntimeError from Path.expanduser() in lifecycle guard

[hashbender]

Summary

cron/lifecycle_guard.py::_resolve_script_path calls Path(script_path).expanduser() to resolve a cron job's script path before scanning it for gateway-lifecycle commands (check_gateway_lifecycle, enforced in cron.jobs.create_job — reachable via both hermes cron create and the agent's cronjob model tool directly).

Path.expanduser() raises RuntimeError (not OSError) for a ~user-shaped path with no matching system user:

>>> from pathlib import Path
>>> Path('~nonexistentuser12345/foo').expanduser()
RuntimeError: Can't determine home directory for 'nonexistentuser12345'

_read_script_for_scanning's except OSError: doesn't catch this, so an LLM-authored script value that happens to start with ~someuser/... (a plausible thing for an agent to produce — the same trigger shape already fixed for agent/subdirectory_hints.py in #c126a99fc, "LLMs use ~ for 'approximately'" or a guessed/malformed path) crashes cron job creation with an unhandled RuntimeError instead of the intended graceful GatewayLifecycleBlocked/pass-through behavior the module is designed around.

Fix

Add RuntimeError to the caught exceptions in _read_script_for_scanning, mirroring the exact fix already applied to agent/subdirectory_hints.py's three Path.expanduser()/Path.home() call sites in #c126a99fc.

Test plan

• New regression test test_tilde_unknown_user_script_does_not_crash — confirmed it fails with an uncaught RuntimeError on the pre-fix code (via git stash) and passes after the fix
• pytest tests/hermes_cli/test_gateway_restart_loop.py -q — 66 passed
• ruff check on all changed files — clean
• Checked for competitors: PR refactor: sweep remaining bare expanduser() to safe_expanduser() (depends on #41870) NousResearch/hermes-agent#41881 ("sweep remaining bare expanduser() to safe_expanduser()") is a 2-file refactor (cron/jobs.py, cron/scheduler.py) that does not include cron/lifecycle_guard.py — confirmed via gh pr view --json files. No overlap.

---

Mirror-of: NousResearch#56517
NousResearch#56517

[tenki-reviewer]

Review Complete
No issues found!

Risk: 🟢 Low (12/100) — no findings · 27 LOC across 2 files

---

Bug fix: handles RuntimeError from tilde path expansion in cron lifecycle guard, preventing crash during security path checks. Includes regression test for gateway restart loop.

Files Reviewed (2 files)

cron/lifecycle_guard.py
tests/hermes_cli/test_gateway_restart_loop.py