feat(ms-ai-architect): add cross-OS scheduling templates (launchd/systemd/Windows) [skip-docs]

scripts/kb-update/templates/ms-ai-architect-kb-update.ps1

@@ -0,0 +1,48 @@
+# ms-ai-architect-kb-update.ps1
+# PowerShell installer fragment for Windows Task Scheduler. Filled in
+# by scripts/install-kb-cron.mjs at install-time and run elevated only
+# if the user requested system-wide install (default is per-user with
+# InteractiveToken so the task fires while the user is logged in).
+
+$TaskName    = 'ms-ai-architect-kb-update'
+$NodeBin     = '{{NODE_BIN}}'
+$PluginRoot  = '{{PLUGIN_ROOT}}'
+$LogFile     = '{{LOG_FILE}}'
+$ScheduleAt  = '{{SCHEDULE_HOUR}}:{{SCHEDULE_MINUTE}}'
+
+$Trigger = New-ScheduledTaskTrigger `
+    -Weekly `
+    -DaysOfWeek Wednesday `
+    -At $ScheduleAt
+
+$Action = New-ScheduledTaskAction `
+    -Execute $NodeBin `
+    -Argument "$PluginRoot\scripts\kb-update\weekly-kb-cron.mjs" `
+    -WorkingDirectory $PluginRoot
+
+# InteractiveToken is the contract: the task only runs while the user is
+# logged in. This avoids the "OAuth dies in cron" failure-mode (claude
+# subscription auth is bound to the keychain, which is unlocked only when
+# the user is logged in). RunLevel Limited keeps the task at non-elevated
+# privileges; admin elevation is unnecessary for per-user scheduling.
+$Principal = New-ScheduledTaskPrincipal `
+    -UserId $env:USERNAME `
+    -LogonType InteractiveToken `
+    -RunLevel Limited
+
+$Settings = New-ScheduledTaskSettingsSet `
+    -AllowStartIfOnBatteries `
+    -DontStopIfGoingOnBatteries `
+    -StartWhenAvailable `
+    -ExecutionTimeLimit (New-TimeSpan -Hours 2)
+
+Register-ScheduledTask `
+    -TaskName $TaskName `
+    -Trigger $Trigger `
+    -Action $Action `
+    -Principal $Principal `
+    -Settings $Settings `
+    -Description 'Weekly Microsoft Learn KB freshness update for ms-ai-architect plugin' `
+    -Force | Out-Null
+
+Write-Host "Registered Windows scheduled task '$TaskName' (weekly Wed $ScheduleAt, log: $LogFile)"