feat(ms-ai-architect): C2.3 onboarding skriver scheduled_detection cadence+enabled via gated CLI (TDD) [skip-docs]

K5 oppfylt: onboarding skriver scheduled_detection-blokka (enabled +
os_scheduler_cadence) til bruker-eid config; parseScheduleConfig leser den
tilbake til samme verdier (round-trip bevist deterministisk).

- serializeScheduleConfig(config) i detection-schedule.mjs — invers av
  parseScheduleConfig, rett ved parseren (én formatsannhet).
- write-schedule-config.mjs (NY, gated CLI, Claude-fri): merger på eksisterende
  config (override kun de to onboarding-eide nøklene; interval_days/
  include_skill_lifecycle overlever). backupFile + atomicWriteSync — ingen rå
  fs-write.
- backupFile(filePath, backupRoot) i lib/backup.mjs — presis enkeltfil-backup.
- onboard.md (orkestrator): «Planlagt deteksjon»-seksjon + scheduler i --status.
  onboarding-agent.md: note om at scheduler er orkestratorens jobb (ingen Bash).
- Avvik fra plan-tekst (dokumentert): scheduler-spørsmål i orkestrator, ikke agent.

Verifisert: detection-schedule 33/33 (+10) · backup-restore 15/15 (+3) ·
kb-update 213 · kb-eval 100 · validate 239/0/0 · test-hooks 11/11 ·
kb-integrity 192/192 · discovery 13/13 · gitleaks 3 pre-eksisterende.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/kb-update/lib/backup.mjs

@@ -15,7 +15,7 @@ import {
   unlinkSync,
   mkdirSync,
 } from 'node:fs';
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
 import { atomicWriteJson } from './atomic-write.mjs';
 
 const META_FILENAME = '.backup-meta.json';
@@ -127,6 +127,36 @@ export function backupDir(srcDir, backupRoot, opts = {}) {
   return { backupPath, retentionDays, restore };
 }
 
+/**
+ * Back up a SINGLE file into backupRoot/<timestamp>/<basename>. No-op (returns
+ * null) when the source file does not exist — a first-time write has nothing to
+ * preserve. Used to guard the C2.3 scheduler-config write: atomic-write handles
+ * partial-write safety; this keeps the prior version recoverable. Precise by
+ * design (does not copy the surrounding dir, so onboarding's org/ data is not
+ * dragged into a backup on every cadence change).
+ *
+ * @param {string} filePath — file to back up
+ * @param {string} backupRoot — parent dir for the timestamped backup subdir
+ * @param {object} [opts]
+ * @param {Date} [opts.now] — override clock for testing
+ * @returns {{backupPath: string}|null}
+ */
+export function backupFile(filePath, backupRoot, opts = {}) {
+  if (!filePath || typeof filePath !== 'string') {
+    throw new Error('backupFile: filePath is required');
+  }
+  if (!backupRoot || typeof backupRoot !== 'string') {
+    throw new Error('backupFile: backupRoot is required');
+  }
+  if (!existsSync(filePath)) return null;
+  const now = opts.now ?? new Date();
+  const destDir = join(backupRoot, backupTimestamp(now));
+  mkdirSync(destDir, { recursive: true });
+  const backupPath = join(destDir, basename(filePath));
+  cpSync(filePath, backupPath, { force: true, preserveTimestamps: true });
+  return { backupPath };
+}
+
 /**
  * True if a stale rollback sentinel exists at backupRoot.
  * @param {string} backupRoot

scripts/kb-update/lib/detection-schedule.mjs

@@ -88,6 +88,41 @@ export function parseScheduleConfig(text) {
   return cfg;
 }
 
+/**
+ * Serialize a schedule config to a full config-file text: a `---`-fenced
+ * frontmatter with the `scheduled_detection:` block (all four known keys) plus a
+ * short human header. The inverse of parseScheduleConfig — C2.3's onboarding
+ * write-path uses THIS (no second format definition): values are normalized
+ * exactly as coerce() would read them, so
+ *   parseScheduleConfig(serializeScheduleConfig(c))
+ * yields a DEFAULT-merged, normalized c (round-trip, acceptance K5). Pure.
+ * @param {Partial<typeof DEFAULT_SCHEDULE_CONFIG>} [config]
+ * @returns {string}
+ */
+export function serializeScheduleConfig(config = {}) {
+  const c = { ...DEFAULT_SCHEDULE_CONFIG, ...config };
+  const interval =
+    Number.isInteger(c.interval_days) && c.interval_days > 0
+      ? c.interval_days
+      : DEFAULT_SCHEDULE_CONFIG.interval_days;
+  return [
+    '---',
+    'scheduled_detection:',
+    `  enabled: ${c.enabled === true}`,
+    `  interval_days: ${interval}`,
+    `  include_skill_lifecycle: ${c.include_skill_lifecycle !== false}`,
+    `  os_scheduler_cadence: ${c.os_scheduler_cadence === 'interval' ? 'interval' : 'daily'}`,
+    '---',
+    '',
+    '# ms-ai-architect — planlagt deteksjon',
+    '',
+    'Skrevet av `/architect:onboard`. Styrer den opt-in, Claude-frie deteksjonen',
+    '(poll → rapport → discovery → skill-livssyklus). Endre `scheduled_detection`-',
+    'blokka over, eller kjør `/architect:onboard` på nytt.',
+    '',
+  ].join('\n');
+}
+
 /**
  * Load the opt-in schedule config. C2.1: the user-owned path
  * (~/.claude/ms-ai-architect/ms-ai-architect.local.md) takes precedence so the