feat(cron): wire on_jobs_changed, cron.chronos config, docs + agent↔NAS contract

Phase 4F (F.1 + F.2 + F.3, agent side). F.4 is the operator-run live smoke
(needs a NAS deployment); recorded in the PR, not code.

F.1 — on_jobs_changed wiring:
- cron/scheduler.py: _notify_provider_jobs_changed() — resolve the active
  provider, call on_jobs_changed(), swallow errors. Lives in scheduler.py (not
  jobs.py) so the store stays free of provider imports (no import cycle).
- Wired at the consumer surfaces AFTER a successful mutation: the cronjob model
  tool (tools/cronjob_tools.py, create/update/remove/pause/resume) — which the
  `hermes cron` CLI also routes through — and the REST handlers
  (gateway/platforms/api_server.py, same five). Built-in's no-op default = zero
  behavior change on the default path. Sleeping-agent direct jobs.json writes
  (no tool/CLI/REST) are covered by reconcile-on-wake in start().

F.2 — config: cron.chronos.{portal_url,callback_url,expected_audience,
nas_jwks_url}. All non-secret; the agent holds no scheduler creds and the
outbound provision call reuses the existing Nous token (no token key). Additive
deep-merge key, no version literal.

F.3 — docs:
- docs/chronos-managed-cron-contract.md: authoritative agent↔NAS wire contract
  (the three agent-cron endpoints + inbound /api/cron/fire + the 3-hop trust
  model + at-most-once/re-arm semantics). This is what the NAS-side agent builds
  against.
- cron-internals.md: "Managed cron (Chronos) for scale-to-zero" section.
- cli-commands.md: cron.provider accepts chronos + the cron.chronos.* keys.
- User docs name no scheduler vendor (QStash is a NAS-internal detail).

INVARIANT re-verified: zero qstash/upstash hits across plugins/cron, gateway,
hermes_cli, tools, website/docs (the one remaining repo hit is an unrelated
Context7 MCP comment in tools/mcp_tool.py).

Tests: test_jobs_changed_notify (5) — notify calls provider hook, swallows
errors, built-in harmless, tool create/remove notify. Full cron + chronos +
webhook + config + api_server_jobs suites green (504 in the cron+chronos+webhook
run).

tests/cron/test_jobs_changed_notify.py

@@ -0,0 +1,101 @@
+"""Tests for on_jobs_changed wiring (Phase 4F.1).
+
+After a store mutation via the consumer surfaces (model tool / CLI / REST), the
+active scheduler provider's on_jobs_changed() must be invoked so an external
+provider (Chronos) re-provisions/cancels. The built-in's no-op default means
+the default path is unchanged.
+"""
+
+import pytest
+
+
+@pytest.fixture
+def temp_home(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    yield tmp_path
+
+
+def test_notify_helper_calls_provider_on_jobs_changed(monkeypatch):
+    """cron.scheduler._notify_provider_jobs_changed resolves the provider and
+    calls on_jobs_changed exactly once."""
+    import cron.scheduler_provider as sp
+    import cron.scheduler as sched
+
+    calls = []
+
+    class Spy(sp.CronScheduler):
+        @property
+        def name(self):
+            return "spy"
+
+        def start(self, stop_event, **kw):
+            pass
+
+        def on_jobs_changed(self):
+            calls.append(1)
+
+    monkeypatch.setattr(sp, "resolve_cron_scheduler", lambda: Spy())
+    sched._notify_provider_jobs_changed()
+    assert calls == [1]
+
+
+def test_notify_helper_swallows_provider_errors(monkeypatch):
+    """A provider that raises in on_jobs_changed must not propagate into the
+    caller (best-effort notify)."""
+    import cron.scheduler_provider as sp
+    import cron.scheduler as sched
+
+    class Boom(sp.CronScheduler):
+        @property
+        def name(self):
+            return "boom"
+
+        def start(self, stop_event, **kw):
+            pass
+
+        def on_jobs_changed(self):
+            raise RuntimeError("kaboom")
+
+    monkeypatch.setattr(sp, "resolve_cron_scheduler", lambda: Boom())
+    sched._notify_provider_jobs_changed()  # must not raise
+
+
+def test_builtin_notify_is_harmless(monkeypatch):
+    """With the built-in provider (default), notify is a no-op and never
+    raises."""
+    import cron.scheduler as sched
+    # default resolution → built-in; just assert it doesn't blow up.
+    sched._notify_provider_jobs_changed()
+
+
+def test_tool_create_notifies_provider(temp_home, monkeypatch):
+    """Creating a job via the cronjob tool path invokes on_jobs_changed."""
+    import cron.scheduler as sched
+    calls = []
+    monkeypatch.setattr(sched, "_notify_provider_jobs_changed",
+                        lambda: calls.append("changed"))
+
+    from tools.cronjob_tools import cronjob
+    import json
+
+    out = json.loads(cronjob(action="create", prompt="echo hi", schedule="every 5m", name="w"))
+    assert out["success"] is True
+    assert calls == ["changed"]
+
+
+def test_tool_remove_notifies_provider(temp_home, monkeypatch):
+    """Removing a job via the tool path invokes on_jobs_changed."""
+    import json
+    from tools.cronjob_tools import cronjob
+
+    created = json.loads(cronjob(action="create", prompt="x", schedule="every 5m", name="r"))
+    jid = created["job_id"]
+
+    import cron.scheduler as sched
+    calls = []
+    monkeypatch.setattr(sched, "_notify_provider_jobs_changed",
+                        lambda: calls.append("changed"))
+
+    out = json.loads(cronjob(action="remove", job_id=jid))
+    assert out["success"] is True
+    assert calls == ["changed"]