Add scheduled HK IPO analyst runner

Request:
- Install systemd-based scheduling for the hk-ipo-analyst automation to run three times per day without overlapping executions.

Changes:
- Added an executable wrapper script that resolves the repository root, acquires a non-blocking flock lock, builds a scheduled analyst prompt, and invokes codex exec with the hk-ipo-analyst skill.
- The installed systemd service and timer live under /etc/systemd/system and are not part of this repository commit.

Verification:
- Ran bash -n scripts/run_hk_ipo_analyst_once.sh.
- Ran git diff --cached --check.
- Ran systemd-analyze verify for hk-ipo-analyst.service and hk-ipo-analyst.timer; only unrelated xfs unit deprecation warnings were reported.
- Enabled hk-ipo-analyst.timer and confirmed the next trigger is 2026-06-22 23:00:00 UTC.

Next useful context:
- The timer schedule is explicit UTC: 07:00, 15:00, and 23:00 UTC daily.
- The wrapper exits successfully without starting a second run when another analyst process holds /run/hk-ipo/analyst.lock.

scripts/run_hk_ipo_analyst_once.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+mkdir -p /run/hk-ipo
+
+exec 9>/run/hk-ipo/analyst.lock
+if ! flock -n 9; then
+  echo "$(date -Is) hk-ipo-analyst already running; skip"
+  exit 0
+fi
+
+cd "${REPO_ROOT}"
+
+AS_OF="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+PROMPT_TEMPLATE="$(cat <<'EOF'
+Use the `hk-ipo-analyst` skill from `.agents/skills/hk-ipo-analyst/SKILL.md`.
+
+Run one scheduled HK IPO analyst refresh as of __AS_OF__.
+
+Goals:
+- Inspect the current worktree and recent git history first.
+- Refresh archived facts through `hk-ipo-archivist` only when needed.
+- Rebuild the analysis dataset when inputs changed or freshness requires it.
+- Produce or update the latest broad IPO candidate report for actionable subscriptions.
+- Keep stage discipline: no later facts leaking into earlier-stage conclusions.
+- Write analyst output in Simplified Chinese.
+- Commit only related project changes and push the current branch if upstream exists.
+- If data is missing or stale, state the `data_gap` clearly instead of guessing.
+- Do not ask interactive questions during this scheduled run.
+- Do not change the systemd units or this wrapper script during this scheduled run.
+EOF
+)"
+PROMPT="${PROMPT_TEMPLATE//__AS_OF__/${AS_OF}}"
+
+codex --search exec \
+  -C "${REPO_ROOT}" \
+  -s danger-full-access \
+  -a never \
+  "${PROMPT}"