fix(core): harden dev NAV cron reconciliation (BRIX-1741)

[quay-worker]

Summary

• Harden the dev Sepolia NAV cron installer so it verifies the live $HERMES_HOME script and cron record after install.
• Add --verify and --run-now modes so operators can prove the host-state job exists and execute the exact materialized publish path for an on-chain freshness update.
• Document why BRIX-1626 did not update the live host by itself and make the host-state reconciliation steps explicit.

Deployment Steps

⚠️ Manual deployment steps needed, will not be operational unless the following steps are taken:

1. Deploy this Hermes Agent version to the live Hermes host.
2. Confirm the host has aws, Foundry cast, SEPOLIA_RPC_URL, a dedicated DEV_NAV_PUBLISH_ACCOUNT or DEV_NAV_PUBLISH_KEYSTORE, DEV_NAV_PUBLISH_PASSWORD_FILE, and either DEV_NAV_PRICE_WEI or a prod RPC env var available in $HERMES_HOME/.env.
3. Run python3 scripts/install_dev_nav_cron.py on the Hermes host.
4. Run python3 scripts/install_dev_nav_cron.py --verify and hermes cron list; confirm exactly one enabled dev-nav-sepolia-daily-publish job appears.
5. Run python3 scripts/install_dev_nav_cron.py --verify --run-now to publish through the installed cron script path.
6. Verify freshness with cast call 0x3dBe8d456198B63d46703bbf8f46778B2922c825 "lastNavUpdate()(uint256)" --rpc-url "$SEPOLIA_RPC_URL" and confirm it matches the publish output timestamp.

Verify the job remains scheduled at 30 6 * * * UTC after the immediate run.

Test Plan

Pre-merge checklist

• /home/hermes/.hermes/hermes-agent/venv/bin/python -m py_compile scripts/install_dev_nav_cron.py tests/scripts/test_install_dev_nav_cron.py
• Temporary $HERMES_HOME smoke: install then --verify succeeds without touching live host state.
• Temporary $HERMES_HOME smoke: duplicate owned jobs are collapsed to one deterministic no-agent job.
• scripts/run_tests.sh tests/scripts/test_install_dev_nav_cron.py (blocked locally because the configured fallback venv does not have pytest installed).

Post-deployment verification

• python3 scripts/install_dev_nav_cron.py --verify succeeds on the Hermes host.
• hermes cron list shows the enabled dev-nav-sepolia-daily-publish job targeting the installed script.
• python3 scripts/install_dev_nav_cron.py --verify --run-now lands a Sepolia transaction and prints the publish timestamp.
• lastNavUpdate() on 0x3dBe8d456198B63d46703bbf8f46778B2922c825 returns the fresh timestamp from the publish output.

[linear]

BRIX-1741

[github-actions]

🔎 Lint report: quay/BRIX-1741 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9779 on HEAD, 9778 on base (🆕 +1)

🆕 New issues (1):

Rule	Count
unresolved-import	1

First entries

tests/scripts/test_install_dev_nav_cron.py:8: [unresolved-import] unresolved-import: Cannot resolve imported module `pytest`

✅ Fixed issues: none

Unchanged: 5058 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[quay-reviewer]

lgtm!