fix(#662): cron fleet audit — crontab parsing, tests, CI validation

- Added VPS crontab backup parsing to cron-audit-662.py
- New audit_fleet() combines hermes cron + VPS crontabs
- load_crontab_backups() reads cron/vps/*-crontab-backup.txt
- 20+ tests: crontab parsing, job categorization, fleet audit,
  timestamp parsing, backup loading
- ci-cron-validate.py: CI gate that fails on systemic failures
- Fresh audit report generated in cron/audit-report.json

Closes #662

scripts/ci-cron-validate.py

@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+"""CI: Validate cron fleet health. Exit 1 on systemic failures."""
+
+import sys
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).parent))
+from cron_audit_662 import audit_fleet, load_cron_state, load_crontab_backups
+
+def main():
+    hermes = load_cron_state()
+    crontabs = load_crontab_backups(Path(__file__).parent.parent / "cron" / "vps")
+    report = audit_fleet(hermes, crontabs)
+    print(f"Cron Audit CI: {report['total_jobs']} jobs — H:{report['summary']['healthy']} T:{report['summary']['transient_errors']} S:{report['summary']['systemic_failures']}")
+    if report["systemic_jobs"]:
+        for j in report["systemic_jobs"]:
+            print(f"  FAIL: {j['name']} — {j['reason']}")
+        sys.exit(1)
+    print("CI PASSED")
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main()