Scheduled tasks — wake-on-change / no-LLM gate

Summary

Add a "no-LLM gate" / wake-on-change mechanism: run a cheap check first, and only wake the agent on a real change (the Hermes wakeAgent pattern).

Part of #189 (scheduled tasks). Split out of #236 (deferred/v2) — needs a pre-fire check mechanism + diff detection, too large for the v2 finish PR (#256).

Scope

• A per-schedule WakeOnChange config: a cheap check (a shell command, an HTTP probe, a git diff) that runs BEFORE the fire. If the check produces no change since the last fire, the fire is skipped (not claimed — NextFireAt advances but Fire is not called).
• The check runs in the tick loop, before Claim. If the check fails (non-zero exit, HTTP error), the fire proceeds (fail-open — a broken check should not silently suppress a schedule).
• The check's output is NOT carried into the fire (it's a gate, not context).
• Use cases: only run a doc-sync schedule when docs actually changed; only run a dependency-bump schedule when a new version is published.

References

• Design: #189 (Prior art: Hermes wakeAgent).
• The v2 finish: #256.

Read #189 and the Hermes wakeAgent prior art first, then trace the scheduled-task tick loop and the Claim/NextFireAt behavior. Done means a per-schedule WakeOnChange check runs before Claim, skips unchanged fires while advancing NextFireAt, and proceeds fail-open when the check errors.