Harden Tempo for the v0.1.0 release

[zekageri]

Summary

Hardens Tempo for the first public v0.1.0 release by addressing the scheduler ownership, completion delivery, timezone/DST, parsing, sun-cycle, schedule validation, and release-engineering issues identified during review.

Scheduler safety

• replaces abandoned raw command ownership with reference-counted command states;
• cancels pending timed-out commands so they cannot apply late side effects;
• waits for commands that already started instead of returning an ambiguous timeout;
• removes caller-owned output pointers from GetJobInfoCommand;
• makes JobInfo names owned fixed-size snapshots;
• owns dedicated-task names inside job records;
• retries completion delivery instead of silently dropping JobFinished events;
• tracks dedicated tasks and hardens worker/executor shutdown;
• prevents inline callbacks from waiting on the scheduler service task;
• validates queue, stack, worker-count, and timeout configuration before startup.

Time and calendar correctness

• serializes process-global timezone changes and local-time conversion;
• scopes local calendar, parsing, and formatting operations to the calling Tempo instance;
• reconstructs local calendar values with tm_isdst = -1;
• calculates local day boundaries using the next local midnight, supporting 23- and 25-hour days;
• preserves exact UTC identity through repeated DST hours;
• rejects invalid input, unsupported leap seconds, and nonexistent spring-forward local times;
• synchronizes NTP listener/state access.

Sun and schedule behavior

• treats location as optional rather than silently defaulting to (0, 0);
• validates paired coordinates and coordinate ranges;
• keys sun-cycle caching by the requested local date and serializes cache mutation;
• makes date-taking daylight/sunrise/sunset checks use the supplied date;
• removes inert Tempo maintenance-task configuration;
• rejects malformed cron expressions, invalid interval ranges, empty weekday masks, and out-of-range custom field bits;
• replaces minute-by-minute cron scanning with calendar-day and allowed-field traversal;
• uses coarse-to-fine moon schedule searches.

Tests and release gates

• adds deterministic C++20 host regression tests with ASan and UBSan;
• covers DST boundaries, repeated local times, invalid parsing, independent Tempo instance timezones, sun-date handling, and schedule validation;
• sets package metadata to 0.1.0;
• adds manifest/README/tag version consistency checks;
• makes metadata lint mandatory;
• gates tag releases on source audit, version checks, host tests, PIOArduino builds, and Arduino CLI builds;
• cancels superseded CI runs for the same source branch.

Validation status

• the sanitizer-enabled host suite passed on the hardened date/schedule implementation before the final test-helper cleanup;
• the final branch revision has fresh Host Tests, Lint, PIOArduino, and Arduino CLI runs queued in GitHub Actions;
• no physical ESP32 hardware test has been performed as part of this PR;
• this PR remains a draft until the final matrix is green and the runtime scheduler changes receive a final review.