fix(routines): crontab lines short enough for cron to actually run

[bborn]

Root cause

renderCronLine inlined the invoking shell's entire $PATH into every crontab line, making them 2,000–2,400 chars, and macOS (Vixie) cron silently drops command lines over ~1,000 chars — so those routines never fired. Separately, the line redirected into <state dir>/cron.log without ensuring that directory exists, so a missing dir also failed the job before ty ever ran.

Fix

• Wrapper script instead of inline PATH. InstallSchedule writes <state dir>/cron-run.sh (0755) that sets PATH (deduplicated) and execs ty run <name>. The crontab line is now <expr> /bin/sh '<wrapper>' >> '<log>' 2>&1 # ty:routine:<name> — ~150 chars regardless of PATH.
• Hard guard: a generated line over 900 chars returns an error instead of being installed.
• mkdir -p the routine state dir at schedule time (both backends; launchd logs there too).
• launchd plist: PATH is deduplicated and XML-escaped (no length issue there, so the wrapper isn't used).
• ty routines schedule --print now also prints the wrapper for the cron backend.
• Cron-marker upsert/remove behavior is unchanged (existing tests pass untouched).

Tests

• 5,000-char PATH → line stays under the limit, contains no PATH=, points at the wrapper; wrapper carries the PATH.
• Overlong line (huge state dir) → error.
• Install creates the state dir and an executable wrapper.
• The wrapper actually runs under /bin/sh: sets PATH (deduped, with a ' in it) and execs ty with run scout.

go test ./internal/routine/ passes. In go test ./..., the only failure is internal/executor TestEnsureTaskWindow_ExportedEnvVarsReachLiveShellPane. It also fails on this host without this change (it depends on tmux) and is unrelated.

After merge: re-run ty routines schedule for ayla-scholarships, ayla-volunteering and ik-board-sweep. I did not touch the live crontab.

🤖 Generated with Claude Code