Blackout windows — suspend an agent during declared periods

There are legitimate periods when an agent should NOT run: a deploy freeze week, the operator's vacation, a known database maintenance window. Today the only way to achieve this is to edit/comment out the schedule in the manifest — which leaves no trail and is easy to forget to re-enable.

Proposal

A [[blackout]] block in agent.toml declaring suspended periods:

[[blackout]]
reason = "Q4 deploy freeze"
start = "2026-12-15T00:00:00Z"
end   = "2026-12-31T23:59:59Z"

[[blackout]]
reason = "weekly maintenance"
recurrence = "weekly"
weekday = "sun"
start_time = "02:00"
end_time   = "04:00"

When the agent's schedule fires inside any blackout window, the daemon logs blackout_active and skips. No failure, no notification.

Acceptance criteria

• Both absolute date ranges and recurring rules (weekly on day X, time Y-Z) parse and apply.
• dotagent why surfaces the active blackout when an agent is suspended.
• Blackouts emit an audit event but no notifier fires.
• dotagent next (sibling issue) skips blackout windows when computing upcoming fires.
• agent-spec.md updated.

Where to start

• crates/dotagent-core/src/manifest.rs — schema.
• crates/dotagent-scheduler/src/lib.rs — fire-decision logic.

Non-goals

• Global blackouts in config.toml (only per-agent for v1).
• Pulling holidays from an external calendar API.

Start with the manifest schema in crates/dotagent-core/src/manifest.rs and the fire-decision logic in crates/dotagent-scheduler/src/lib.rs. Trace how dotagent why, audit events, and notifications represent a skipped fire, then verify absolute and recurring blackouts, the documented agent-spec.md changes, and interaction with the sibling dotagent next issue.