Summary

Fixes #11438
Fixes #11452

One-shot at cron jobs that complete with a non-"ok" status (e.g. "error", "skipped") enter an infinite retry loop because computeJobNextRunAtMs returns the original (past) atMs, causing findDueJobs to immediately re-trigger the job. This generates 1,900+ failed attempts in 5 seconds and pegs the gateway at 100% CPU.

Problem

When an at job finishes with any non-"ok" status:

1. onTimer calls computeJobNextRunAtMs(job, result.endedAt)
2. For at jobs, this returns the original atMs (already in the past)
3. armTimer fires immediately, findDueJobs picks up the job again
4. Repeat → infinite retry storm with ~2-3ms between attempts

Solution

Disable one-shot at jobs after any terminal status (ok, error, skipped), not just ok. One-shot jobs are inherently run-once — if the job fails or is skipped, the user can manually re-enable or re-create it.

This applies to both onTimer (timer-triggered) and executeJob (cron run command) code paths.

Changes

• src/cron/service/timer.ts: Simplify at job post-execution to disable on any terminal status
• src/cron/service.runs-one-shot-main-job-disables-it.test.ts: Add regression test
• CHANGELOG.md: Add entry referencing both issues

Testing

• New unit test: "disables a one-shot at job after failure to prevent retry storm"
• All 87 cron tests pass (pnpm vitest run src/cron/)
• Real-environment verification with standalone script: