cron: gate the default inbox-processor on unread messages

[serxa]

What

The messages run gate required an explicit sources list, so the built-in inbox-processor shipped ungated — it woke every 30 minutes even when the inbox was empty. Each idle wake still spawns an agent and pays to re-prime the prompt cache (the poll interval is far longer than the cache TTL), so a large share of the cron's cost buys nothing.

This generalizes the gate and turns it on by default:

• messages gate sources is now optional. With no sources, the gate fires when any source the consumer already tracks has unread messages, via a new read-only, expiry-agnostic db.consumer_has_unread(consumer) — it compares each tracked source's max rowid against the stored cursor (even one past its TTL) and never initializes or advances a cursor.
• The default inbox-processor now ships run_if: [{type: messages, consumer: inbox}]. Idle polls are skipped (no agent spawned) without hard-coding the particular set of connected sources, so it works for every user regardless of which sources they've enabled — the same way task-planner already ships a tasks gate.

Behavior / compatibility

• When the inbox has new messages, the job runs exactly as before — no message is ever skipped, only idle wakes.
• Explicit-source gates (sources: [gmail, github]) and the legacy skip_when_idle shorthand are unchanged. An empty/omitted skip_when_idle still means "don't gate" (a gate is synthesized only when it's non-empty).
• Expiry-agnostic by design: list_consumer_cursors hides cursors past their 2-day TTL, so gating on it would let a long-quiet inbox wedge shut once its cursors expire; consumer_has_unread avoids that.

Testing

• Gate unit tests: no-sources gate satisfied iff the consumer has unread; the path is read-only (asserts neither get_consumer_cursor nor set_consumer_cursor is called); from_config / describe / empty-list semantics; default inbox-processor ships the generic (source-less) gate and it builds.
• DB tests for consumer_has_unread: true when behind, false when caught up, ignores an untracked source, and still reports a backlog when the cursor has expired (while list_consumer_cursors returns none).
• Full suite: 3029 passed (the single failure is a pre-existing, unrelated test_xmemory_bridge test).