feat(reconcile): walk Proton once the last walk is a week old

[jshvn]

Why

The Proton walk ran on the first run of a configured UTC weekday, which ties it to when a run is dispatched. A walk left partial also waited for a later day's first run. lib v2.2.0 (katoptra/lib#12) moves the decision into the toolbox's due, keyed on the age of the last reconcile.

What

• Taskfile
  • due runs after clock in pipeline and in plan-pipeline.
  • RECONCILE_HOURS: 168 keeps the walk weekly.
  • pull and push over the image's s3 are what due and reconciled keep .state/reconciled through, as plain text.
  • record-walk runs the toolbox's reconciled only when .run/walked exists. Its status gate lets render.txt show the write.
• Python
  • The run row's reconcile is whether .run/reconcile exists.
  • p60, the walk phase, touches .run/walked after a complete walk, so a partial walk stays due and the next run resumes it.
  • clock clears a stale walked.
  • reconcile.weekday, the RECONCILE environment variable and is_reconcile_run are gone. A leftover [reconcile] table is now an unknown table, and the config refuses it.
• Docs: README and CLAUDE.md.

This merges only after lib v2.2.0, which is already released: the pipeline calls due, and earlier releases do not have it.

Test plan

• task test: 160 passed. New: state records the toolbox's flag; a complete walk leaves walked and a partial one does not; clock clears walked.
• task lint
• render.txt rendered against lib v2.2.0. The check job re-renders it.