feat(ms-ai-architect): C2.3 onboarding skriver scheduled_detection cadence+enabled via gated CLI (TDD) [skip-docs]

K5 oppfylt: onboarding skriver scheduled_detection-blokka (enabled +
os_scheduler_cadence) til bruker-eid config; parseScheduleConfig leser den
tilbake til samme verdier (round-trip bevist deterministisk).

- serializeScheduleConfig(config) i detection-schedule.mjs — invers av
  parseScheduleConfig, rett ved parseren (én formatsannhet).
- write-schedule-config.mjs (NY, gated CLI, Claude-fri): merger på eksisterende
  config (override kun de to onboarding-eide nøklene; interval_days/
  include_skill_lifecycle overlever). backupFile + atomicWriteSync — ingen rå
  fs-write.
- backupFile(filePath, backupRoot) i lib/backup.mjs — presis enkeltfil-backup.
- onboard.md (orkestrator): «Planlagt deteksjon»-seksjon + scheduler i --status.
  onboarding-agent.md: note om at scheduler er orkestratorens jobb (ingen Bash).
- Avvik fra plan-tekst (dokumentert): scheduler-spørsmål i orkestrator, ikke agent.

Verifisert: detection-schedule 33/33 (+10) · backup-restore 15/15 (+3) ·
kb-update 213 · kb-eval 100 · validate 239/0/0 · test-hooks 11/11 ·
kb-integrity 192/192 · discovery 13/13 · gitleaks 3 pre-eksisterende.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/kb-update/lib/backup.mjs

@@ -15,7 +15,7 @@ import {
   unlinkSync,
   mkdirSync,
 } from 'node:fs';
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
 import { atomicWriteJson } from './atomic-write.mjs';
 
 const META_FILENAME = '.backup-meta.json';
@@ -127,6 +127,36 @@ export function backupDir(srcDir, backupRoot, opts = {}) {
   return { backupPath, retentionDays, restore };
 }
 
+/**
+ * Back up a SINGLE file into backupRoot/<timestamp>/<basename>. No-op (returns
+ * null) when the source file does not exist — a first-time write has nothing to
+ * preserve. Used to guard the C2.3 scheduler-config write: atomic-write handles
+ * partial-write safety; this keeps the prior version recoverable. Precise by
+ * design (does not copy the surrounding dir, so onboarding's org/ data is not
+ * dragged into a backup on every cadence change).
+ *
+ * @param {string} filePath — file to back up
+ * @param {string} backupRoot — parent dir for the timestamped backup subdir
+ * @param {object} [opts]
+ * @param {Date} [opts.now] — override clock for testing
+ * @returns {{backupPath: string}|null}
+ */
+export function backupFile(filePath, backupRoot, opts = {}) {
+  if (!filePath || typeof filePath !== 'string') {
+    throw new Error('backupFile: filePath is required');
+  }
+  if (!backupRoot || typeof backupRoot !== 'string') {
+    throw new Error('backupFile: backupRoot is required');
+  }
+  if (!existsSync(filePath)) return null;
+  const now = opts.now ?? new Date();
+  const destDir = join(backupRoot, backupTimestamp(now));
+  mkdirSync(destDir, { recursive: true });
+  const backupPath = join(destDir, basename(filePath));
+  cpSync(filePath, backupPath, { force: true, preserveTimestamps: true });
+  return { backupPath };
+}
+
 /**
  * True if a stale rollback sentinel exists at backupRoot.
  * @param {string} backupRoot