fix: schedule index / API / RBAC

[heerambavi1998]

Summary

• Add a unique index on schedule name scoped to tenant, agent
• Add API to list runs for a schedule.
• Add RBAC on schedules - same as sessions. Creators can see their own schedules ( + runs) , admins can see all.

How was this tested?

unit tests added

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
Adds authorization checks and a DB unique index migration that can fail if duplicate schedule names already exist; otherwise read-only listing plus stricter access on existing schedule endpoints.

Overview
Adds GET /api/v1/schedules/{schedule_id}/runs to return a schedule’s runs ordered by newest scheduled_for, with wire types ScheduleRun / ListScheduleRunsResponse and SDK client.schedules.listRuns.

Schedule access now matches sessions-style scoping: non-admins only see and mutate schedules they created (list filters by created_by; get/update/delete/list-runs return 403 for other users’ schedules). Admins bypass the creator check. Missing schedules still return 404 (no existence leak).

Names are unique per agent via a new schedule_name_uq index on (tenant_id, agent_name, name) (Postgres + SQLite migrations). Duplicate create/rename surfaces 409 through ScheduleNameConflictError; OpenAPI 409 text also mentions name collisions alongside concurrent-modify conflicts.

Store layer gains listRuns; ScheduleRunStatus moves into the public schedule schema; create/update paths map unique violations to the new error class.

^{Reviewed by Cursor Bugbot for commit edc3dee. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: edc3dee

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 67d0be4. Configure here.}