Stale timer sweep skips removal when disable fails

[vishr]

internal/engine/schedule.go:93

"systemctl disable --now %s.timer >/dev/null 2>&1 && rm -f /etc/systemd/system/%s.timer /etc/systemd/system/%s.service"

The && ties removal to a successful disable. A unit systemd cannot disable leaves both files on disk, and because the command runs under mutateChecked the non-zero status aborts the deploy — so the sweep neither completes nor leaves the host in the state the next run expects. The disable and the removal want separate handling.

---

Split out of #50 as item 5.