Make routines act on their own and check every bot action

Scheduled runs are pre-approved: they carry out their brief instead of
drafting for confirmation. A run that can't do its brief calls
report_run_failed and is retried 5 and 10 minutes later; only then does
the user get one "failed after N tries" message, and the routine keeps
why in last_error.

Every reply and task now gets ActionCheckNote: look for an existing
record before creating one, and verify an action took effect before
saying it's done. Memory and instructions saves are read back, and
create_bot, create_schedule, start_task and delegate_task refuse
duplicates.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/cron-jobs/record-cron-job-failure.ts

@@ -0,0 +1,21 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+
+type Params = {
+    cron_job_id: number;
+    /**
+     * The run's job: only the schedule's latest run records its failure.
+     */
+    job_id: number;
+    error: string;
+};
+
+/**
+ * Keeps why a schedule's latest run failed in `last_error`, so Routines
+ * shows it. The next run that's queued clears it.
+ */
+export default async function recordCronJobFailure({ cron_job_id, job_id, error }: Params) {
+    await BunSQLite.sql({
+        sql: `UPDATE cron_jobs SET last_error = ?, updated_at = ? WHERE id = ? AND last_job_id = ?`,
+        values: [`Last run failed: ${error}`, Date.now(), cron_job_id, job_id],
+    });
+}