CRONSCOPE r2 quality Lows: the dispatch-failure notice in run_one_job and
the env build in _launch_external_cron_worker each hand-rolled the same
install / try / finally / reset around _install_fire_secret_scope. Add
_fire_secret_scope() next to the helper pair and use it at both sites;
reset order is unchanged (it still delegates to _reset_fire_secret_scope).
Also collapse the five-line comment at the dispatch-failure site to one.
_run_one_job_body keeps its tokens (the reset sits in a larger finally) and
scheduler_worker_failure.py is untouched (mark_job_run shares its finally).
8d15ca4878