feat(contracts,db): scheduled_job registry tables and schedules API contracts

- 0028_scheduled_jobs: scheduled_job (stable key, group, kind task|agent_check,
  enabled/schedule with defaults + customized flag, config, last_* / next_run_at /
  run_requested_at / running_since, counters) and scheduled_job_run history
- contracts/schedules.ts: ScheduleSpec (interval | 5-field cron), AgentCheckConfig
  (goal template, capability allowlist, budget, trigger condition, allowRecover,
  reportAsDecision), board / run views
- Api.schedules: list, create (agent_check only), update, remove, run-now, skip,
  runs; all admin + console session only

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/db-sync.test.ts

@@ -100,6 +100,9 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   SlotDeferral: { row: C.SlotDeferral },
   SlotUnit: { row: C.SlotUnit },
   SubscriptionHistory: { row: C.SubscriptionHistory },
+  // W7-C 定时任务(0028):board_group 在 API 里叫 group;default_enabled 只用于"恢复默认"
+  ScheduledJob: { row: C.ScheduledJob, dbOnly: ["boardGroup", "defaultEnabled"], apiOnly: ["group"] },
+  ScheduledJobRun: { row: C.ScheduledJobRun },
   // W7-A Pi 上游(0027):secret_ref 不出 API
   PiUpstream: { row: C.PiUpstreamRow, dbOnly: ["secretRef"] },
 };
@@ -194,6 +197,11 @@ const ENUMS: Record<string, z.ZodEnum> = {
   ReconcileRunMode: C.ReconcileMode,
   ReconcileRunStatus: C.ReconcileStatus,
   SecretPurpose: C.SecretPurpose,
+  ScheduledJobBoardGroup: C.ScheduleGroup,
+  ScheduledJobKind: C.ScheduleKind,
+  ScheduledJobLastStatus: C.ScheduleRunStatus,
+  ScheduledJobRunTrigger: C.ScheduleTrigger,
+  ScheduledJobRunStatus: C.ScheduleRunStatus,
   PiUpstreamAuthKind: C.PiAuthKind,
   PiUpstreamStatus: C.PiUpstreamStatus,
   PiUpstreamThinkingLevel: C.PiThinkingLevel,