fix(calendar-sync): run the sync from a timer instead of the agenda hook

The hourly timer armed itself from org-agenda-mode-hook, so a session where
I never opened the agenda never synced at all. After a reboot that is every
session until the first agenda call. I found it with all three calendar
files still frozen at the pre-reboot write, five hours stale.

The deferral had a real reason. Feed URLs behind :secret-host live in
authinfo.gpg, and starting at load would prompt for a passphrase on a cold
gpg-agent. The cost was worse than what it bought.

A user timer owns the schedule now, every ten minutes.
calendar-sync-auto-start defaults to nil so the editor no longer arms its
own. scripts/calendar-sync-run is the batch entry point, and it blocks
until every calendar leaves the syncing state. The pipeline is asynchronous
end to end, so a batch Emacs that returns early exits zero having written
nothing.

Installing it on a machine that resolves its feeds through :secret-host
surfaced two bugs the inline-url machine could never show:

- cj/auth-source-secret-value called auth-source-search behind nothing but
  a declare-function, which quiets the compiler and loads nothing. An
  interactive Emacs always has auth-source in by the time anyone calls, so
  the omission stayed invisible until a batch -Q sync died on a void
  function. The require is guarded on fboundp. An unconditional one reloads
  auth-source over whatever is already there, which replaced a caller's
  stubbed search mid-call and sent an existing test out to the real
  authinfo.

- A synchronous failure in one calendar aborted the whole loop. The async
  callbacks record their own failures, but they never run when the error
  lands before a process starts. Resolving a :secret-host feed signals
  outright on a cold agent. Failures are contained per calendar now, so one
  bad feed no longer costs the other two.

A failed row prints the reason it recorded. Batch Emacs discards the
*Messages* buffer the interactive path logs to, so without it the journal
shows only "error", with no way to tell a cold agent from a revoked token.

1 files changed, 15 insertions, 1 deletions

diff --git a/modules/system-lib.el b/modules/system-lib.el
index bde53d82..c6021c9c 100644
--- a/modules/system-lib.el
+++ b/modules/system-lib.el
@@ -8,7 +8,8 @@
 ;; Eager reason: low-level helpers (executable lookup, process output, silent
 ;;   logging) used by many eager modules during startup.
 ;; Top-level side effects: none.
-;; Runtime requires: none (auth-source loaded on demand inside the helper).
+;; Runtime requires: none at load (auth-source is required on demand inside
+;; `cj/auth-source-secret-value', so the cost lands only on callers that use it).
 ;; Direct test load: yes (pure helpers; batch-safe).
 ;;
 ;; This module provides low-level system utility functions for checking
@@ -125,6 +126,19 @@ This does so without echoing in the minibuffer."
 With USER, also match on the login.  Resolves a function-valued secret
 \(the netrc backend returns the secret as a function\) by calling it.
 Callers that must have a secret layer their own error on top."
+  ;; Loaded here rather than at the top of the file, so a module that merely
+  ;; requires system-lib does not pay for auth-source.  It has to be loaded
+  ;; *somewhere*, though: `declare-function' only quiets the byte-compiler.
+  ;; An interactive Emacs always has auth-source in by the time anyone calls
+  ;; here, which hid the omission until a batch `-Q' sync tried to resolve a
+  ;; `:secret-host' feed and died on a void `auth-source-search'.
+  ;;
+  ;; Guarded on `fboundp' rather than calling `require' unconditionally: a
+  ;; bare require re-loads auth-source.el over whatever is already in place,
+  ;; which replaces a caller's stubbed `auth-source-search' mid-call and sends
+  ;; a test that meant to fake the lookup out to the real authinfo instead.
+  (unless (fboundp 'auth-source-search)
+    (require 'auth-source))
   (let* ((spec (append (list :host host :require '(:secret) :max 1)
                        (when user (list :user user))))
          (secret (plist-get (car (apply #'auth-source-search spec)) :secret)))