fix(cron): add service-layer timezone validation

Adds `_validate_schedule_for_add()` to `CronService.add_job` so that
invalid or misplaced `tz` values are rejected before a job is persisted,
regardless of which caller (CLI, tool, etc.) invoked the service.

Surfaces the resulting `ValueError` in `nanobot cron add` via a
`try/except` so the CLI exits cleanly with a readable error message.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nanobot/cron/service.py

@@ -45,6 +45,20 @@ def _compute_next_run(schedule: CronSchedule, now_ms: int) -> int | None:
     return None
 
 
+def _validate_schedule_for_add(schedule: CronSchedule) -> None:
+    """Validate schedule fields that would otherwise create non-runnable jobs."""
+    if schedule.tz and schedule.kind != "cron":
+        raise ValueError("tz can only be used with cron schedules")
+
+    if schedule.kind == "cron" and schedule.tz:
+        try:
+            from zoneinfo import ZoneInfo
+
+            ZoneInfo(schedule.tz)
+        except Exception:
+            raise ValueError(f"unknown timezone '{schedule.tz}'") from None
+
+
 class CronService:
     """Service for managing and executing scheduled jobs."""
     
@@ -272,6 +286,7 @@ class CronService:
     ) -> CronJob:
         """Add a new job."""
         store = self._load_store()
+        _validate_schedule_for_add(schedule)
         now = _now_ms()
         
         job = CronJob(