Couple questions:

1. What kinds of operations should be available in the API / hooks?
2. Should custom code still be allowed to be used (unsafe, but more flexible), or should it strictly only allow defined hook functions to run (safer, but less flexible unless people know how to make hooks)?

Ok...

The code in the hooks should just directly replace what the current schedulable things are. That is- scheduled news, scheduled topic posting, scheduled forum replying, scheduled newsletters. grep code for 'add_calendar_event'.

I suggest a Commandr command called 'run_scheduled_action', which runs the code from the hooks. E.g. "run_scheduled_action publish_news 10 1234453445"

I suggest a 'schedule' function in maybe global4.php. This should add to the calendar using the Commandr code above. You'd call the function like:
schedule('publish_news',$id,$timestamp);
(I edited slightly from the original text on this issue)

The capability to run arbitrary Commandr code on calendar events should be untouched. But with this we're at least just running Commandr code rather than PHP code running under Commandr (via leading ":" symbol).

Hopefully makes sense.