fix(acp): disable goose cron scheduler in managed agent children

[wpfleger96]

A Buzz install with a scheduled goose recipe fires each cron entry once per goose acp child instead of once, because every child unconditionally starts its own cron scheduler over the shared ~/.local/share/goose/schedule.json. With a pool of N children per harness and multiple harnesses, one scheduled recipe fans out to N × harness_count executions — each running under the managed agent's identity rather than the operator's, and racing the operator's own standalone goose over the same schedule file.

This injects GOOSE_ACP_SCHEDULER_DISABLED=true into every child spawned by AcpClient::spawn, so a managed agent never owns the operator's cron schedule.

Placement

The cmd.env call is set last — after the extra_env operator-wins loop and after the CODEX_CONFIG merge — deliberately with no escape hatch. Managed children not running the operator's schedule is a correctness invariant rather than an operator-tunable default, so the injection must beat both a conflicting persona extra_env entry and any value inherited from the parent process.

It is injected for all agents, not just goose. Agent builds that don't recognize the variable ignore it.

Sequencing

The goose-side flag that reads this variable and skips scheduler startup lands separately (repo TBD). Until it does, this change is a forward-compatible no-op: it sets an environment variable nothing currently reads. Merging it first means no coordinated release is needed — the fix takes effect as soon as the goose side ships.

Related: aaif-goose/goose#10738