[LeonSGP43]

Summary

• always repair $HERMES_HOME/cron ownership on container boot, matching the existing profiles repair path
• keep cron state readable after root-context docker exec writes or scheduler writes
• add a regression test that locks in the unconditional ownership repairs for both profiles/ and cron/

Testing

• bash -n docker/stage2-hook.sh
• uv run --frozen --extra dev pytest tests/test_docker_home_override_scripts.py -q
• uv run --frozen ruff check tests/test_docker_home_override_scripts.py
• git diff --check

Closes #41966