BINKY-WP-0003-T04: bridge scheduler prepared (rhythm-session.sh + docs)

Headless lane-restricted rhythm session script and enable/disable docs in
OperatingRhythm.md. Crontab installation itself is a one-line founder
action — the permission layer refuses agent-installed persistence, which
is the correct boundary.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

OperatingRhythm.md

@@ -33,6 +33,31 @@ Rules:
    the top.
 4. Workplan files match hub state (fix-consistency covers drift).
 
+## Bridge scheduler (workstation cron)
+
+**Status: prepared, not installed** — installing a self-running agent loop is
+a founder action (the Claude Code permission layer rightly refuses to let an
+agent install its own persistence). Everything else is ready:
+`scripts/rhythm-session.sh` runs a headless, lane-restricted Claude Code
+session that does queue hygiene, writes the daily brief, and pulls one
+autopilot item (agent name `agt-rhythm-bridge`; flock guard, logs to
+`~/.cache/binky-control/rhythm/cron.log`).
+
+**Enable (founder, one line):**
+```bash
+( crontab -l; echo '23 8 * * 1-5 /home/worsch/binky-control/scripts/rhythm-session.sh # binky rhythm bridge' ) | crontab -
+```
+
+**Disable:** `crontab -e` and delete the `binky rhythm bridge` line.
+
+This is explicitly a **bridge**: once activity-core definitions (T05) and an
+llm-connect executor (T06 follow-up) are live, the cron line is removed and
+scheduling moves to the sanctioned coordination layer.
+
+Guardrails baked into the script: Green/Blue lane only, allowed tools limited
+to file edits + git add/commit, no push, no network, one-run-at-a-time lock,
+bounded "maintenance pass" prompt.
+
 ## Weekly review (founder, ~15 min)
 
 Read the newest brief + `SuccessMilestones.md`. One question: did anything