docs: route web sentinel cadence through k3s

.agents/skills/unidesk-monitor/SKILL.md

@@ -15,6 +15,7 @@ description: UniDesk monitoring and Web sentinel operations. Use when working on
 - 哨兵观察对象是 HWLAB Web 用户入口和业务 E2E 链路；不是让一个哨兵观察另一个哨兵。
 - YAML 是 source of truth。node/lane、sentinel id、Deployment、Service、PVC、route prefix、cadence、Secret sourceRef、dashboard public URL 和 report views 都必须从 YAML/configRef 进入受控 CLI。
 - 正式读写 GitHub issue/PR 走 `$unidesk-gh`；部署、Argo、git-mirror、PipelineRun、runtime 状态走 `$unidesk-cicd` 和受控 CLI；YAML 正规化走 `$unidesk-ymalops`。
+- HWLAB Web 哨兵 cadence 调度必须落在目标 node/lane 的 k3s CronJob/GitOps 中；不要用本机或远端 systemd timer 承载周期巡检。systemd 只可用于明确标注的历史/非 k3s legacy 排查。
 - 诊断可用 `curl` 或一次性 `web-probe script` 采证，但重复 dashboard 验证必须沉淀为受控 `web-probe sentinel dashboard verify|screenshot` 或等价入口。
 - `web-probe sentinel dashboard screenshot` 必须作为远程浏览器截图入口使用，PNG 默认下载到调用者 `/tmp`；issue/PR 证据引用 `localPath`、`sha256`、HTTP status、DOM 摘要和 overflow 结果。
 
@@ -28,12 +29,12 @@ bun scripts/cli.ts web-probe sentinel validate --node D601 --lane v03 --sentinel
 bun scripts/cli.ts web-probe sentinel dashboard verify --node D601 --lane v03 --sentinel <id>
 bun scripts/cli.ts web-probe sentinel dashboard screenshot --node D601 --lane v03 --sentinel <id>
 bun scripts/cli.ts web-probe sentinel report --node D601 --lane v03 --sentinel <id> --latest --view summary
-bun scripts/web-probe-sentinel-scheduler.ts status-systemd --node D601 --lane v03
-bun scripts/web-probe-sentinel-scheduler.ts install-systemd --node D601 --lane v03 --confirm
-bun scripts/web-probe-sentinel-scheduler.ts run --node D601 --lane v03 --sentinel <id> --stale-multiplier 1 --dry-run
+bun scripts/cli.ts web-probe sentinel control-plane trigger-current --node D601 --lane v03 --sentinel <id> --confirm
+trans D601:k3s kubectl -n <namespace> get cronjob -l app.kubernetes.io/component=cadence-scheduler
+trans D601:k3s kubectl -n <namespace> create job --from=cronjob/<quick-verify-cronjob> <manual-job-name>
 ```
 
-`status-systemd` and `install-systemd` without `--sentinel` cover every enabled sentinel from the YAML registry and should expose missing per-sentinel timers; add `--sentinel <id>` only for a targeted single-sentinel operation.
+For k3s cadence validation, first use the controlled control-plane status/trigger commands, then inspect the rendered CronJob in the target k3s namespace. Manual `kubectl create job --from=cronjob/...` is validation evidence only; persistent cadence changes must be made through YAML/GitOps and redeployed.
 
 For long Workbench/user-path evidence, use the normal Web probe surface: