RFC: add 7x24 housekeeper control plane and isolated media jobs

[nxs9bg24js-tech]

Summary

• add a housekeeper control plane with persisted mode state, execution profile resolution, admission checks, night budgets, dedup, circuit breaker, and morning summaries
• inject expanded execution profiles into Telegram, manager dispatch, and planner entrypoints without rewriting the existing manager/worker chain
• add an isolated media job service/router plus narrow Telegram routing for explicit video/audio/subtitle/metadata requests and conservative bare-video URLs
• add systemd units and targeted tests for housekeeper and media flows

Validation

• PATH="$PWD/.venv/bin:$PATH" .venv/bin/pytest -q tests/test_housekeeper.py tests/test_media_jobs.py tests/test_manager_agent.py tests/test_autoresearch_planner.py tests/test_gateway_telegram.py
• result: 45 passed in 5.86s

Notes

• this PR intentionally excludes unrelated local changes in .gitignore, docs/linux-remote-worker.md, memory/2026-03-30.md, .env.linux.example, scripts/dispatch_to_linux.sh, and tests/test_dispatch_to_linux.py
• current review base is codex/docs-cc-switch-workstation so the diff stays scoped to this RFC implementation

[nxs9bg24js-tech]

Update before review:

• fixed explicit media prefixes so video|audio|subtitle|metadata <url> now also enforce the allowed-domain gate
• fixed media output ownership by isolating outputs under per-job directories instead of scanning an entire bucket
• fixed night tick semantics so an open circuit breaker reports circuit_breaker_open instead of budget_exhausted
• latest targeted regression run: 47 passed in 3.86s via PATH="$PWD/.venv/bin:$PATH" .venv/bin/pytest -q tests/test_media_jobs.py tests/test_housekeeper.py tests/test_gateway_telegram.py tests/test_manager_agent.py tests/test_autoresearch_planner.py

[nxs9bg24js-tech]

第二轮复审结论：此前 blocker 已修。媒体路由收紧、输出隔离、night tick 语义修正都已落地；从当前实现和范围边界来看，这条 PR 已达到可以合并的质量线。\n\n需要单独说明的是：我这里给的是代码审查结论，不等于 GitHub checks 已全部放行。是否现在就 merge，还要看仓库对未通过检查的 PR 是否允许合并。