[Golden Test] Create and wire the daily cron job

[PeterJhongLinksys]

Part of the daily golden-CI triage agent buildout.

Create the Hermes cron job that runs the agent daily.

• Schedule: Taiwan 08:00 (CI worst-case done by ~07:00).
• Pin model opus (bedrock) — needs vision for PNG judging; pinning avoids global model.default drift blocking the run.
• deliver=telegram (CLI-scheduled cron is local-only; must target the gateway to actually notify).
• Attach the playbook; run collector first, feed its JSON to the agent.
• Mirror the shape of the existing PR-review / GitHub-Mentions crons.

Tracking issue for automation infra (no PrivacyGUI app code changes).

[PeterJhongLinksys]

✅ Dev done — cron job created, wired, verified, and live.

Job: c87aec449b57 "PrivacyGUI Golden Daily Triage"

• Schedule: 0 8 * * * (Taiwan 08:00). CI starts 04:00 and finishes in ~1.5 h (observed 82–92 min, well under the 180 min timeout), so the report is ready by then; the collector still polls the run to completion before judging.
• Model pinned to global.anthropic.claude-opus-5 / bedrock. Pinning is required for two reasons: the agent needs vision to read diff images, and an unpinned job is refused outright after a global default-model change.
• Attached playbook: the job prompt is deliberately a thin shim whose first mandatory action is read_file on ~/.hermes/automation/prompts/golden-daily-PrivacyGUI.md. All authoritative logic stays in that one editable file rather than being duplicated into the job record.

deliver: local, NOT telegram — non-obvious but important: the playbook pushes Telegram itself via pipelines/common/notify.py. Setting deliver=telegram would additionally forward the agent's final response, producing two messages per day. Same convention as the existing PR-review and mentions-watcher jobs.

Go-live gating: the job was created PAUSED on purpose and only resumed after the end-to-end dry-run (#1189) passed against a real failing report, so it could never write to this repo before the judging layer had been validated.

Note for future maintenance: cronjob action='run' fires the job on demand even while paused, so the schedule never needs editing to test it — but that path performs real writes.