fix: validate cron no-agent update invariants

[sgtworkman]

Summary

• Enforce cron no-agent update invariants at the jobs data layer
• Reject clearing script while no_agent=True
• Reject toggling promptless/skill-less no-agent jobs back into empty agent mode
• Align cron script empty-output test with the current silent-skip behavior
• Replace docs ASCII box diagrams with Mermaid so diagram lint stays green

Test Plan

• scripts/run_tests.sh tests/cron/test_cron_no_agent.py -q (RED before fix: 4 new tests failed)
• scripts/run_tests.sh tests/cron -q
• cd website && PATH="$HOME/Library/Python/3.14/bin:$HOME/.local/bin:$PATH" npm run lint:diagrams
• cd website && npm run build (passes; existing broken-link warnings remain)

Notes

Follow-up to #19709. This closes the lifecycle sharp edge where a valid no-agent watchdog could be updated into no_agent=True with no script, or into agent mode with no prompt/skills.

[sgtworkman]

CI workflows are currently in GitHub action_required state for this fork PR, so no jobs/logs are available yet. Local validation before opening: scripts/run_tests.sh tests/cron -q → 323 passed; npm run lint:diagrams → 0 errors; npm run build completed successfully with existing unrelated broken-link warnings.