fix(cron): deliver full SQLite TEXT for job schedule and message

[cursor]

Bug and impact

cron_job_get_next_due / cron_job_list copied SQLite TEXT into schedule[128] and message[512] via copy_str_bounded. The full string was stored on create. The truncated copy was what cron_poll parsed and injected.

Trigger A: a recurring interval: job whose stored schedule is longer than 127 bytes (valid at create, for example interval: plus padding zeros plus 60). On fire, the clipped schedule no longer parses (interval:0 or a cut number), so cron_job_update_next_run is skipped. The row stays due and cron_poll delivers it on every main-loop tick: repeated agent_run / provider calls until the process is stopped.

Trigger B: a reminder whose message is longer than 511 bytes (email draft, meeting notes). The job fires with a silently clipped prompt. The agent acts on incomplete instructions.

Distinct from #57 (commit before delivery) and #65 (cron_next_from_expr returning the current minute).

Root cause

Fixed-size cron_job_row_t buffers cannot hold unbounded SQLite TEXT. Truncation was silent. Failed reschedule left next_run in the past.

Fix

Heap-copy schedule and message on read. Callers cron_job_row_free() the row. Poll, tool list, and dashboard list all go through that path.

Validation

• make test_cron: all tests passed, including full 599-byte message delivery and a 131-byte interval: schedule that advances next_run so a second poll is idle
• make test_memory: passed
• Same test_cron under GCC ASan/UBSan with leak detection: passed
• GATEWAY=1 routes.c was not compiled here (no libwebsockets). The list handler only adds cron_job_row_free around the existing JSON build.