fix: scheduler-audit-fixes — fix audit findings in src/scheduler

[avoidwork]

Description

Fix two audit findings in the scheduler module: a high-severity security vulnerability where job.command is interpolated directly into crontab entries without sanitization (allowing crontab format injection via newlines), and a medium-severity bug where persistJobFile ignores its cwd parameter.

Type of Change

• Bugfix (non-breaking change which fixes an issue)

Testing

• Unit tests for sanitizeCrontabCommand helper: normal commands pass through, commands with newlines/carriage returns are sanitized, shell special characters preserved, empty commands handled
• Integration test for persistJobFile cwd parameter usage
• All existing scheduler tests verified to still pass

Coverage

• 100% line coverage maintained

Checklist

• npm run lint passes
• Tests pass with 100% line coverage
• No forbidden patterns used
• Conventional Commit style applied