Operations timezone

The one instance-wide IANA timezone baseline every cadence is relative to. A ProgramSchedule stores only its wall-clock hour; that hour is interpreted against the operations timezone, and the scheduler's Croner fires it there → the exact absolute (UTC) instant. So a cadence set to "9am" fires at 9am in this zone, and changing the baseline re-relativizes every cadence at once — the one-action way to relocate (Sydney → New York) without editing a single domain. It is Director-only (set in Settings → Timezone) and instance-wide: every member operates under it. Cadence times display in this zone first with the absolute UTC alongside, so "when does this run" is never ambiguous. Stored in the record meta (aux/meta.json operationsTimezone); read by both the clients and the daemon scheduler.