fix: push a FAILED notification when a scheduled run dies without reporting

sync pushes its result only from the end of a run it finished, so a crash or an early exit sent nothing, while the providers that survived kept pushing OK. The systemd unit now runs scheduling/run-sync.sh, which keeps the per-provider loop and pushes a high-priority failure, with the exception class only, for any run that exited non-zero without the app's own report.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LbnmGHnFqDjyhPcCg1SEfF

README.md

@@ -429,7 +429,8 @@ cache on the next run that finds Joplin up.
 providers in a single action rather than one action each, because systemd
 `oneshot` stops at the first failing `ExecStart` and Task Scheduler reports only
 the last action's result. Every provider is attempted; the run still exits
-non-zero if any failed.
+non-zero if any failed. On Linux the loop is `scheduling/run-sync.sh`, which the
+unit's `ExecStart` calls.
 
 ### Getting notified
 
@@ -457,6 +458,16 @@ high priority with an alert tag, so a failed archive is distinguishable from a
 quiet one on your phone. `NTFY_NOTIFY=failure` notifies only on failure; `off`
 disables it; `--notify` / `--no-notify` override per run.
 
+`sync` can only push from the end of a run it finished. A crash, an exit before
+the sync starts (the ToS gate, a cache error) or a launcher that can't build its
+venv sends nothing — and since each provider pushes separately, the ones that
+succeeded still say "OK", so a dead provider looks like a quiet day. On Linux,
+`scheduling/run-sync.sh` closes that gap: any run that exits non-zero without the
+app having reported it gets a high-priority **FAILED** push naming the provider
+and, for a crash, the exception's class (`claude-code: crashed (RecursionError)`)
+— the class only, never its message, which can carry a conversation title. The
+traceback is in the journal. The Windows task has no such backstop yet.
+
 The message includes the **machine name**, which matters because both machines
 archive into one topic. It contains counts only — never conversation titles. A
 topic on public ntfy.sh is readable by anyone who knows its name, so if you want