cron: schtasks + modal first real-target validation; promote CI legs to strict

[shitianfang]

First contact happened in CI (cron-smoke.yml, add → list → remove against the real
schedulers): ubuntu crontab green, macos launchd green, windows schtasks failed, modal
not yet exercised (dispatch-only, token-gated).

The windows catch: schtasks create failed: ERROR: The task XML is malformed. /
(1,40)::ERROR: unable to switch the encoding — the task XML's encoding declaration
disagrees with the bytes actually written (position 1,40 is the declaration's encoding
attribute).

Work: fix the schtasks XML encoding; run the modal leg once with real token secrets; then
flip continue-on-error off for macos and windows in cron-smoke.yml (macos has already
earned it) and drop the experimental caveat from the backend docs.