feat(scheduler): Backend interface + FileBackend + CronJob manifest helpers (#162 part 2)

[initializ-mk]

Summary

First half of part 2 of the #162 stack. Introduces the `ScheduleBackend` abstraction the runtime and `forge package` both consume, ships the `FileBackend` wrapping existing behavior with zero observable change, and lands the pure-Go CronJob manifest builders + in-cluster detection helper that parts 2b/3 build on.

Scope split inside part 2

`#162 part 2` as originally scoped was "backend interface + impls + auto-detection." The K8s runtime CRUD implementation requires `k8s.io/client-go`, a ~10 MB transitive dependency. To keep this PR reviewable I split:

Sub-part	Scope	Status
2 (this PR)	`ScheduleBackend` interface, `FileBackend` refactor, `CronJobYAML` + `CronJobName` + `InCluster` helpers, forge.yaml config block. Zero new deps.	this PR
2b	`KubernetesBackend` with `k8s.io/client-go` for runtime CronJob CRUD (enables the LLM-driven `schedule_set` path)	next
3	`forge package` wires the CronJob manifests + Secret template + Role into the build output	last

This PR alone is enough to ship static-schedule K8s deploys end-to-end once part 3 lands — `forge.yaml` schedules become CronJobs at build time, the cluster's CronJob controller handles timing, no runtime API calls needed.

Files

File	Change
`forge-core/scheduler/backend.go` (new)	`Backend` interface (Start, Stop, Reload, Sync, List, Get, Set, Delete, History, Store); `FileBackend` wrapping `Scheduler` + `ScheduleStore`; `SourceYAML` / `SourceLLM` constants
`forge-core/scheduler/k8s_detect.go` (new)	`InCluster()` + `FORGE_IN_CLUSTER` override
`forge-core/scheduler/k8s_manifest.go` (new)	`CronJobName` (deterministic, 63-char safe via hash-suffix) + `CronJobYAML` (pure-Go manifest text, shell-escaped task body)
`forge-core/types/config.go`	`SchedulerConfig` + `K8sSchedulerConfig` blocks
`forge-cli/runtime/runner.go`	Swap `r.sched *Scheduler` for `r.schedBackend Backend`; FileBackend constructed at the existing wiring point. Zero behavior change.
`docs/deployment/scheduler-kubernetes.md` (new)	Operator-facing reference: resolution ladder, manifest shape, token plumbing via `forge auth`, security model

Behavior change

None. `FileBackend` is a structural wrapper around the existing `Scheduler` + `MemoryScheduleStore`. The 30s ticker, the SCHEDULES.md persistence, the overlap-skip behavior, the audit events — all unchanged. The lazyScheduleReloader still works because Backend.Reload delegates through.

The `scheduler` block in forge.yaml is purely additive — the existing `schedules[]` array continues to work as before.

Reconciliation rules pinned by Sync

Case	Behavior
New yaml-sourced entry	Insert
Existing yaml-sourced entry	Update task / cron / channel, preserve LastRun / RunCount / LastStatus
yaml-sourced entry no longer in manifest	Delete
LLM-sourced entry	Always preserved — the LLM owns the chat-created schedule, the declarative reconcile path doesn't touch it

Test: `TestFileBackend_SyncPreservesLLMSourced` pins the LLM-preservation invariant.

CronJob manifest shape (used by parts 2b + 3)

```yaml
apiVersion: batch/v1
kind: CronJob
metadata:
name: forge-<agent_id>-<schedule_id> # 63-char safe, hash-suffix when truncating
labels:
forge.agent.id: <agent_id>
forge.schedule.id: <schedule_id>
forge.schedule.source: yaml | llm
spec:
schedule: ""
concurrencyPolicy: Forbid # K8s-native overlap skip
jobTemplate:
spec:
template:
spec:
containers:
- name: trigger
image: curlimages/curl:8.10.1
env:
- name: FORGE_AUTH_TOKEN
valueFrom: {secretKeyRef: {name: <agent_id>-internal-token, key: token}}
command: ["sh", "-c"]
args:
- curl -sfX POST -H 'Authorization: Bearer $FORGE_AUTH_TOKEN' -H 'X-Forge-Schedule-Id: ' --data '...'
```

`X-Forge-Schedule-Id` is the hook part 3 uses for audit-event linkage (the agent recognizes scheduled fires and emits `schedule_fire` / `schedule_complete` around the normal A2A dispatch).

Test plan

• `go test -count=1 ./...` clean in forge-core and forge-cli
• `golangci-lint run ./...` → 0 issues in both modules
• `gofmt -w` applied
• All 10 new tests pass:
  • FileBackend (5): Sync upserts, Sync prunes, Sync preserves LLM-sourced, Sync preserves per-run state, Store() accessor
  • CronJob manifest (5): name fits K8s limits, name uniqueness via hash-suffix, manifest has required fields, defaults applied, single-quote shell escaping
• All existing scheduler tests pass (Scheduler_SingleFire, Reload, Overlap, StartStop — verifying the FileBackend wrapper doesn't regress timing semantics)
• Manual end-to-end deferred to part 3 (when forge package wires the manifest builder)

Refs #162