Scheduled security-scan ownership (rkhunter/clamav) + fleet-wide systemd/cron job registry with heartbeat monitoring on venus

Elazar 2026-07-12: rkhunter is running weekly via TWO duplicate systemd units (scan-rkhunter-venus.timer + rkhunter-scan.timer, both Sat) — accidental double-run/double-email. Root ask: (1) fix rkhunter dup + drop cadence to monthly (just-in-case scan, no windows-vm/office-doc attack surface); (2) drop clamav-scan.timer biweekly->monthly, same reasoning; (3) nw-venus-cc takes FULL ownership+responsibility of both scans going forward, no ambiguity; (4) design+build a fleet-wide scheduled-job registry covering every systemd timer/cron.d entry on venus (34 timers found in initial sweep: name/cadence/purpose/owner/sense-check), because Sonnet has no innate sense of time and cannot notice a missing report on its own; (5) that registry needs a heartbeat/dead-man's-switch watchdog that checks systemd's own last-trigger state (not just 'did an email arrive') so a silently-broken timer gets caught, and confirms healthy jobs positively ('ran, found nothing' = visible signal, not silence).