fix(scheduler): resolve guest routing when check_defs.target_type is blank

Older writeCheck inserts omitted target_type, so every seed-created check_def
had a NULL/empty target_type. checkSSHScript's IsGuest check then never matched,
and guest checks silently fell back to their baked (often mesh-only) address —
keeping them 'down' even after the pct-exec routing and deployed scripts were
in place. rclone stayed down for exactly this reason after the host-hop fix.

writeCheck now writes target_type, and checkSSHScript resolves the type from
the target_id when the column is blank (a runtime safety net for existing rows;
the seed rows were also backfilled in the live DB).

internal/scheduler/scheduler.go

@@ -767,6 +767,15 @@ func checkSSHScript(ctx context.Context, pool *db.Pool, cd sqlcgen.ListEnabledCh
 	if cd.TargetType != nil {
 		targetType = *cd.TargetType
 	}
+	// target_type was omitted by older writeCheck inserts, so resolve it from
+	// the target entity when the column is blank — otherwise the guest routing
+	// below (IsGuest) never triggers and a guest check falls back to its baked
+	// (often mesh-only) address.
+	if targetType == "" && cd.TargetID != nil {
+		if err := pool.QueryRow(ctx, "SELECT type FROM entities WHERE id = $1", *cd.TargetID).Scan(&targetType); err != nil {
+			targetType = ""
+		}
+	}
 	if cd.TargetID != nil {
 		switch {
 		case remote.IsGuest(targetType):