fix(schedules): refresh untouched builtin config so checks get new capabilities

Built-in agent checks kept the config stored at first registration, so
check.pending never received decision.list / subscription.list added in
AG-3 and the patrol could not read pending items (REAL-2 scenario g).
Track config_customized (migration 0045); sync replaces config with the
code default unless the user PATCHed it. Needs image rebuild.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/db-sync.test.ts

@@ -108,8 +108,12 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   SlotDeferral: { row: C.SlotDeferral },
   SlotUnit: { row: C.SlotUnit },
   SubscriptionHistory: { row: C.SubscriptionHistory },
-  // W7-C 定时任务(0028):board_group 在 API 里叫 group;default_enabled 只用于"恢复默认"
-  ScheduledJob: { row: C.ScheduledJob, dbOnly: ["boardGroup", "defaultEnabled"], apiOnly: ["group"] },
+  // W7-C 定时任务(0028):board_group 在 API 里叫 group;default_enabled 只用于"恢复默认";config_customized(0045)只供启动同步
+  ScheduledJob: {
+    row: C.ScheduledJob,
+    dbOnly: ["boardGroup", "defaultEnabled", "configCustomized"],
+    apiOnly: ["group"],
+  },
   ScheduledJobRun: { row: C.ScheduledJobRun },
   // W7-A Pi 上游(0027):secret_ref 不出 API
   // 0044 远程模型表:经 GET /pi/upstreams/{id}/models 单独返回,不进上游行