feat(scheduler): gate DRM jobs and emit liveness

[tyecam1]

Summary

Add deployment-specific fail-closed controls for vault-backed DRM schedules: verify the current heartbeat and action allowlist before shell actuation, emit periodic TaskRun liveness, and cap LLM/research tasks at a one-hour default. The change is a draft and does not restart or reconfigure the live service.

Target branch

• This PR targets dev.

This deployment fork intentionally stages the patch against its curated main; it is not an upstream merge request.

Linked Issue

Issue tracking is disabled in this deployment fork. Operational tracking is in the obsidian-PhD task package; #2 is the durable draft-PR tracking reference.

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change
• Refactor / cleanup
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs; this is not a duplicate.
• This PR targets dev.
• My changes are limited to the scope described above.
• I ran the full app end-to-end.

How to Test

1. Set ODYSSEUS_DRM_VAULT_ROOT to a fixture or deployment checkout containing automation/config/odysseus_actions.yaml and a current heartbeat.
2. Run /home/agent/projects/odysseus/venv/bin/python -m pytest -q tests/test_drm_runtime_guard.py tests/test_vault_heartbeat.py on the compute box.
3. Confirm the 12 tests pass, then review the service environment before any restart or deployment.

Deployment gate

Before deployment, set ODYSSEUS_DRM_VAULT_ROOT to the checkout that receives the daily heartbeat. No live service configuration was changed by this PR.

Visual / UI changes

None.