cron-scheduler: fix fabricated command syntax in evidence blocks

The two blocks added earlier this pass showed 'curl | jq' syntax that
was never actually run - the real command was 'curl | python3 -c'
via SSH. The output text was genuinely real either way, but the
command shown wasn't what produced it. Replaced with the literal
command actually executed, re-run fresh to confirm the output still
matches.

docs/cron-scheduler.md

@@ -34,21 +34,34 @@ Populating 50 rows by hand across a dozen-plus different systems wasn't just dat
 - **Don't trust a duration number until it comes from a real completed run.** `app-update`'s first-logged duration was ~2-3 seconds — which turned out to be sampled from killed, failed, and paused runs, not a real completion. The actual number, from a genuine successful run, is ~16 minutes: an 8x difference between "what the data said" and "what actually happened," caught only by checking. This is the actual row note, not a paraphrase:
 
   ```
-  $ curl -s -H "xc-token: [REDACTED]" ".../api/v2/tables/<cron-scheduler>/records" \
+  $ curl -sk -H "xc-token: [REDACTED]" "https://nocodb.[app-to-app zone]/api/v2/tables/<table-id>/records?limit=100" \
-    | jq -r '.list[] | select(."Job Name"=="app-update (Kestra)") | .Notes'
+    | python3 -c "
-  Duration corrected 2026-07-31: real successful completion took ~16min -
+  import json,sys
-  the earlier ~2-3s figure came from KILLED/FAILED/PAUSED runs, not a
+  d = json.load(sys.stdin)
-  real completion.
+  for r in d['list']:
+      if r.get('Job Name') == 'app-update (Kestra)':
+          print(r.get('Notes'))
+  "
+  Kestra flow homelab/app-update. Checks non-Docker app updates + ansible
+  venv. 1h after os-update-vms same night. Duration corrected 2026-07-31:
+  real successful completion took ~16min - the earlier ~2-3s figure came
+  from KILLED/FAILED/PAUSED runs, not a real completion.
   ```
 - **The heaviest job in the entire fleet isn't a backup.** Radarr's own `Refresh Movie` task runs ~1h15min daily — heavier than any single PVE backup job, and the heaviest scheduled task found anywhere in the *arr media suite. Radarr's own backup job, by contrast, finishes in about 41 seconds.
 - **A 404 that looked like an auth problem wasn't one.** Pulling Authentik's 18 internal task schedules initially 404'd against the endpoint documented for older versions (`/admin/system_tasks/`) — the real one had moved to `/api/v3/tasks/schedules/` in the installed version. A wrong assumption about *why* something failed costs more time than the actual fix would have. Same live query, same real note:
 
   ```
-  $ curl -s -H "xc-token: [REDACTED]" ".../api/v2/tables/<cron-scheduler>/records" \
+  $ curl -sk -H "xc-token: [REDACTED]" "https://nocodb.[app-to-app zone]/api/v2/tables/<table-id>/records?limit=100" \
-    | jq -r '.list[] | select(."Job Name"|test("Authentik")) | .Notes'
+    | python3 -c "
+  import json,sys
+  d = json.load(sys.stdin)
+  for r in d['list']:
+      if 'Authentik' in (r.get('Job Name') or ''):
+          print(r.get('Notes'))
+  "
   Resolved via GET /api/v3/tasks/schedules/ 2026-07-29 (endpoint moved
   from the old /admin/system_tasks/ path in this Authentik version -
-  that's why the first attempt 404'd, not an auth problem).
+  that's why the first attempt 404'd, not an auth problem). [...]
   ```
 
 ---