Fix the schedule execution-order gap: run every/at bodies sequentially

[imattau]

Summary

Real fix (not a workaround) for the schedule-execution-order gap NCC-PLAN.md recorded as a follow-up: a schedule's body used to run through two disconnected static passes — top_level_publications for literal-field publishes, top_level_operation_calls for bare operation calls — so a let computed in a schedule body never reached a later publish or print in the same body. examples/service-operator-bot.ns hit exactly this building its encrypted Locator refresh and had to work around it by moving the sequence into a handler.

• Interpreter::statement's Every/At arm (previously Err(unsupported(...))) now runs self.block(body) — a schedule's body executes exactly once, inline, through the same sequential evaluator a handler body already gets. This is real evaluation of the one firing every host already guaranteed (startup) — not new periodic-timer support; deploy still only registers the timer for actual refiring.
• A new eval::run_schedule_bodies drives this at the top level; deferred_spans now also excludes a schedule's span from the two old static passes, so nothing runs twice.
• nscript-cli's run_program/deploy_program run the old static passes first, completely unchanged, then run_schedule_bodies through a small EvalHost wrapper that traces to the exact same operation N: <value> / publication N: <accepted>/<total> relays accepted output format startup already used — continuing the same counters — plus a log <level>: <message> line for a schedule's own print, which finally runs.
• Scoped deliberately to schedule bodies, not the whole top-level program. An earlier version of this fix ran all top-level code through the sequential evaluator. Checked against every file in examples/ and conformance/valid/ (not just the test suite), it broke roughly twenty fixtures that rely on the type checker's own leniency toward a bare demo identifier used only as a typed argument, or bind select ... from .../latest ... from ... expressions the plain evaluator has never implemented. No schedule body in this codebase uses either shape, so narrowing the fix to schedule bodies keeps the real bug fixed with zero regressions — verified by diffing every example's nscript run output before and after.
• examples/service-operator-bot.ns now runs its encrypted Locator refresh directly inside every 24h { ... } alongside the other three publishes — the fix, not the workaround.

Test plan

• cargo build --workspace — clean
• cargo test --workspace — all tests pass (250 nscript-runtime + 69 CLI tests, 1 ignored), including a new library-level test for run_schedule_bodies and an updated CLI test for the composite example
• cargo fmt --check — clean
• cargo clippy --workspace --tests -- -D warnings — clean
• Ran every file in examples/ and conformance/valid/ before and after, diffed output: only 4 files changed, all four gaining exactly the print their schedule always should have produced, nothing newly broken (the remaining 4 files that fail nscript check were already failing identically before this change, unrelated to it — pre-existing gaps referencing hypothetical custom modules)

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01D95PWA2fdNfg7nUvUHBeMi

---

Generated by Claude Code