Scoresby's point about bots is the strongest argument for "hard", and I think you can have both. Separate the two jobs:
Grand prize: tuned to be hard, no fixed end date. Make the hint schedule conditional rather than monthly: a hint only drops after N months with no claim (e.g. the first at 6 months, then every 3). If it falls in 4 months you're fine, and if it would take 2 years like Noizat's, the hints stop it stalling into a dead hunt. You keep Scoresby's "don't expect a solve in under a year" without the risk that it never ends.
Checkpoints: small and early, as a progress signal, not prize money. Keep them around 5-10% of the total so the big wallet still feels big (Scoresby's point 3). Their job is to tell solvers they're on the right path, and to produce a public "stage 2 claimed" event while the main prize waits.
On bots specifically: what an AI or a script does well is brute force and general cipher knowledge. Against brute force, use a slow KDF on the final answer. Against the rest, use clues that need knowledge of your novel's plot, which no model has seen, since the book is new and only exists in that edition. Ciphers alone are what bots solve fastest, and story-dependent steps are what they solve slowest. So the hardness should sit in the story-dependent steps, not in the crypto.
Scoresby's point about bots is the strongest argument for "hard", and I think you can have both. Separate the two jobs:
On bots specifically: what an AI or a script does well is brute force and general cipher knowledge. Against brute force, use a slow KDF on the final answer. Against the rest, use clues that need knowledge of your novel's plot, which no model has seen, since the book is new and only exists in that edition. Ciphers alone are what bots solve fastest, and story-dependent steps are what they solve slowest. So the hardness should sit in the story-dependent steps, not in the crypto.