Maintenance Scheduler
Run scripts/plan.py to keep the maintenance schedule current.
At review time this only writes a human-readable schedule. A second branch is
dormant until the configured maintenance window opens; once it does, the
scheduler queues that window's maintenance commands into .cache/policy.json
for the updater to pick up.
Until that date the scheduler is inert: nothing is queued and the updater has nothing to apply.