feat(v2): add pre-task script hook for scheduled tasks

Scheduled tasks can now carry a bash script that runs inside the container
before the agent is invoked. The script prints `{wakeAgent, data?}` on its
last stdout line; if `wakeAgent: false` (or the script errors) the task
row is marked completed and the agent is never queried, saving API calls
on no-op checks. On wake, the script's `data` is injected into the task
prompt. Semantics mirror V1: 30s bash timeout, 1MB buffer, last-line JSON,
error == skip.

Also blocks the Claude SDK's built-in scheduling tools (CronCreate,
CronDelete, CronList, ScheduleWakeup) via `disallowedTools` so tasks
actually flow through `mcp__nanoclaw__schedule_task` and get the script
gate. CLAUDE.md gains a soft pointer explaining why `schedule_task` is
the right path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

container/agent-runner/src/providers/claude.ts

@@ -9,6 +9,11 @@ function log(msg: string): void {
   console.error(`[claude-provider] ${msg}`);
 }
 
+// Deferred SDK builtins that would sidestep nanoclaw's own scheduling.
+// Scheduling goes through mcp__nanoclaw__schedule_task so that tasks are
+// durable across sessions/restarts and gated by our pre-task script hook.
+const SDK_DISALLOWED_TOOLS = ['CronCreate', 'CronDelete', 'CronList', 'ScheduleWakeup'];
+
 // Tool allowlist for NanoClaw agent containers
 const TOOL_ALLOWLIST = [
   'Bash',
@@ -211,6 +216,7 @@ export class ClaudeProvider implements AgentProvider {
         resume: input.continuation,
         systemPrompt: instructions ? { type: 'preset' as const, preset: 'claude_code' as const, append: instructions } : undefined,
         allowedTools: TOOL_ALLOWLIST,
+        disallowedTools: SDK_DISALLOWED_TOOLS,
         env: this.env,
         permissionMode: 'bypassPermissions',
         allowDangerouslySkipPermissions: true,