The cron handler previously called ensureInit without env, so the search sink was never armed on scheduled ticks and ingest never fed Meilisearch. It now passes env, and the arming call runs inside the existing ingest timeout race rather than ahead of it, so a stalling settings endpoint cannot push a tick past the cron interval. The settings PATCH is bounded by an AbortSignal, which also backstops the user-facing xrpc arming path. Adds tests pinning that an arming failure neither 500s the tick nor stops ingest, and that arming and ingest share one budget.