feat(ms-ai-architect): C2.3 onboarding skriver scheduled_detection cadence+enabled via gated CLI (TDD) [skip-docs]

K5 oppfylt: onboarding skriver scheduled_detection-blokka (enabled +
os_scheduler_cadence) til bruker-eid config; parseScheduleConfig leser den
tilbake til samme verdier (round-trip bevist deterministisk).

- serializeScheduleConfig(config) i detection-schedule.mjs — invers av
  parseScheduleConfig, rett ved parseren (én formatsannhet).
- write-schedule-config.mjs (NY, gated CLI, Claude-fri): merger på eksisterende
  config (override kun de to onboarding-eide nøklene; interval_days/
  include_skill_lifecycle overlever). backupFile + atomicWriteSync — ingen rå
  fs-write.
- backupFile(filePath, backupRoot) i lib/backup.mjs — presis enkeltfil-backup.
- onboard.md (orkestrator): «Planlagt deteksjon»-seksjon + scheduler i --status.
  onboarding-agent.md: note om at scheduler er orkestratorens jobb (ingen Bash).
- Avvik fra plan-tekst (dokumentert): scheduler-spørsmål i orkestrator, ikke agent.

Verifisert: detection-schedule 33/33 (+10) · backup-restore 15/15 (+3) ·
kb-update 213 · kb-eval 100 · validate 239/0/0 · test-hooks 11/11 ·
kb-integrity 192/192 · discovery 13/13 · gitleaks 3 pre-eksisterende.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/kb-update/test-backup-restore.test.mjs

@@ -17,6 +17,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
   backupDir,
+  backupFile,
   detectStaleRollback,
   cleanupOldBackups,
   backupTimestamp,
@@ -97,6 +98,34 @@ test('backupDir — copies content faithfully (deep equal)', () => {
   });
 });
 
+// --- backupFile: precise single-file backup (C2.3 config-write guard) ---
+
+test('backupFile — copies one file into a timestamped subdir, preserving content', () => {
+  withTmp((tmp) => {
+    const file = join(tmp, 'ms-ai-architect.local.md');
+    const root = join(tmp, '.backups');
+    writeFileSync(file, 'PRIOR CONTENT', 'utf8');
+
+    const res = backupFile(file, root);
+    assert.ok(res && res.backupPath, 'returns the backup path');
+    assert.match(res.backupPath, /\.backups\/\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}\/ms-ai-architect\.local\.md$/);
+    assert.equal(readFileSync(res.backupPath, 'utf8'), 'PRIOR CONTENT');
+  });
+});
+
+test('backupFile — no-op (returns null) when the source file is absent', () => {
+  withTmp((tmp) => {
+    const res = backupFile(join(tmp, 'does-not-exist.md'), join(tmp, '.backups'));
+    assert.equal(res, null);
+    assert.equal(existsSync(join(tmp, '.backups')), false, 'no backup dir created when nothing to back up');
+  });
+});
+
+test('backupFile — throws on missing args', () => {
+  assert.throws(() => backupFile('', '/tmp/x'), /filePath/);
+  assert.throws(() => backupFile('/tmp/x', ''), /backupRoot/);
+});
+
 test('backupDir — writes .backup-meta.json sentinel inside backup', () => {
   withTmp((tmp) => {
     const src = join(tmp, 'skills');