Run scheduled tasks with bounded, revocable user authority

Outcome

A user can create a schedule for a fixed agent and operation. Timer and "run now" executions act only within that user-approved scope, until expiry or revocation.

Proposed approach

• The authenticated owner's successful schedule create/update request is the recorded consent event; there is no mandatory second Mecatl consent screen.
• The schedule binds an exact agent revision, integration, operation, target, cadence, expiry, and execution limits.
• It references a signed Scheduled Authority Grant, not a user login token, provider access token, or provider refresh token.
• The protected authority service holds any provider refresh credential.
• Every fire checks the current grant state, schedule state, policy, agent/integration revision, and exact requested operation before obtaining fresh short-lived authority.
• Expiry, revocation, drift, missing credentials, and unavailable/indeterminate policy fail closed.
• Manual and timer fires share one authority path.

Not in this issue

A generic approval UI, broker replication, service-identity fallback, or silently using "latest" agent/integration configuration.

Dependencies

The protected-operation authority path from #1564 (external action without exposed credentials). Provider OAuth consent, including any offline_access request, remains in the interactive provider-connection flow; it is separate from Mecatl's schedule-create consent event.

Proof

• An expired or revoked schedule never executes under service/ownerless authority and names the reason.
• A schedule cannot fire as a different agent, integration, target, or broadened operation.
• Manual and automatic fires have the same effective authority.
• Provider credentials never enter Mecatl state or model-visible output.

Hazards (carried over from the original issue body)

Facts that were expensive to find and that nobody re-derives on the way to implementing. Each is verified against code.

• Never fall back to a service identity when the user's grant expires. That turns an expiry into an escalation.
• The model must not be able to author the consent record.
• An absent user cannot consent at fire time, so capture-at-create is the only user-consent path for unattended work. The alternative is an admin pre-authorizing a class of agents, which substitutes organizational authority for the user's. There is no third option, and which one applies should be a stated decision rather than a consequence of the implementation.
• "Signed" is worth whatever the signing key's custody is worth. A key held in the agent-loop process is reachable from a shell the model drives without touching memory — see #375 for the verified evidence.

Correction to the previous version of this issue

The previous body said authority is replayed "with no live lookup that can fail or drift." That claim does not hold: the signed grant prevents unauthorized row mutation, but only authoritative fire-time checks (grant state, schedule state, policy, credential availability) make revocation, disablement, current policy, and provider-connection loss effective. The design must not silently turn an outdated signature into continuing authority — every fire re-checks live state, per the "Proposed approach" above.