NotebookLM Auth Preflight — keepalive + pre-show recovery

OVERRIDES runtime profile: uses direct_mixed because this task invokes NO Claude CLI — it calls the NotebookLM token API (Google), Playwright/Chromium, and Telegram (scripts/notify.py) directly. No LLM is used, so the wrapper claude provider profile does not apply (rule 8).

Keeps NotebookLM auth durable so radio-daily-brief and social-pulse stop failing with "Authentication expired or invalid".

The scheduler evaluates cron in SAST wall-clock (see scheduler.is_due), and those shows fire at 05:00 / 05:30 SAST. So this runs at 00:30 / 02:30 / 04:30 SAST — the last is ~30 min before the 05:00 radio show. Each cycle:

1. Probe — authenticated NotebookLMClient.from_storage() + notebooks.list(). This is also the keepalive: a real authenticated request warms Google's server session so the static cookie snapshot does not idle-rot. The happy path launches NO browser (no Chromium thrash / profile contention).
2. Recover — if the snapshot is dead (or near show time, even on a transient- looking error), re-derive a fresh storage_state.json headed on display :1 from the persistent ~/.notebooklm/browser_profile, then re-probe against the real token API.
3. Alert (only if still dead) — scripts/notify.py Telegram to Elmar to re-auth via VNC. The 05:00/05:30 shows are inside notify.py quiet hours (21:00–06:00 SAST), so the 04:30 pre-show run forces the alert past quiet hours; the 00:30 / 02:30 keepalive runs respect quiet hours (silent) so Elmar is not woken on a transient blip.

notify_on: never because the script owns its own quiet-hours-aware, specific alert — the scheduler's generic failure ping would duplicate it and ignore quiet hours. A non-zero exit (2 = needs human re-auth, 1 = transient) still surfaces on the health dashboard. Survival metric: ~/.notebooklm/preflight.log (one JSON line per cycle). Runbook: runbooks/notebooklm-auth-durability.md.