v4.1.2: WATCH_CVE guard on scheduled heavy-job rules

Hot fix. cve-watch schedules (WATCH_CVE=true) were running the
heavy DAG. Now gated on WATCH_CVE != true. Recurring rebuild
schedules (basef-recurring, no WATCH_CVE) still run heavy DAG.