fix(schedules): refresh untouched builtin config so checks get new capabilities

Built-in agent checks kept the config stored at first registration, so
check.pending never received decision.list / subscription.list added in
AG-3 and the patrol could not read pending items (REAL-2 scenario g).
Track config_customized (migration 0045); sync replaces config with the
code default unless the user PATCHed it. Needs image rebuild.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/db/migrations/0045_scheduled_job_config_customized.ts

@@ -0,0 +1,23 @@
+import type { Kysely } from "kysely";
+import { execDdl } from "../src/migration-helpers.ts";
+
+// 内置定时任务的 config 只在用户改过(PATCH config)时保留表内值;没改过的行在启动同步时整体换成代码默认值,
+// 否则代码新增的默认项(如巡检白名单新增的 decision.list / subscription.list)永远进不了旧行。
+// 已有行:内置巡检的白名单与 0.2.2 默认值不同的视为用户改过。
+
+// biome-ignore lint/suspicious/noExplicitAny: 迁移不依赖应用表类型
+export async function up(db: Kysely<any>): Promise<void> {
+  await execDdl(
+    db,
+    `alter table scheduled_job add column config_customized boolean not null default false;
+     update scheduled_job set config_customized = true
+      where not builtin
+         or (kind = 'agent_check' and config->'capabilityAllowlist' is distinct from
+             '["catalog.lookup","release.search","release.inspect","inventory.query","task.inspect","identity.resolve"]'::jsonb);`,
+  );
+}
+
+// biome-ignore lint/suspicious/noExplicitAny: 同上
+export async function down(db: Kysely<any>): Promise<void> {
+  await execDdl(db, `alter table scheduled_job drop column if exists config_customized;`);
+}

packages/db/src/types.ts

@@ -1265,6 +1265,7 @@ export interface ScheduledJobTable {
   schedule: Json;
   default_schedule: Json;
   customized: Generated<boolean>;
+  config_customized: Generated<boolean>;
   config: Generated<Json>;
   last_run_at: Timestamptz | null;
   last_status: ScheduledJobLastStatus | null;