fix(cron): clean up HERMES_CRON_SESSION env var after each job to prevent process-wide leak into gateway sessions

[webtecnica]

Summary

Fixes #60350. The cron ticker sets os.environ["HERMES_CRON_SESSION"] = "1" as a process-global marker that is never cleared. When the gateway runs cron ticks in a background thread (same process), this env var leaks into all subsequent interactive gateway sessions, falsely identifying them as cron sessions. The approval guard reads this env var and applies cron_mode: deny, permanently blocking execute_code and dangerous terminal commands for interactive users.

Root cause

cron/scheduler.py:2590 sets the env var. The code comment explicitly acknowledges it persists for the process lifetime. Gateway cron ticks share the same process, so interactive sessions inherit the marker.

Fix

Added os.environ.pop("HERMES_CRON_SESSION", None) in the finally block of run_job(), so it is cleaned up regardless of success or failure. Parallel jobs are serialized by the existing cwd lock, and the env var is re-set at each job start, so clearing at the end is safe.

Related issues

• Closes [Bug] execute_code blocked in WeCom gateway session — HERMES_CRON_SESSION env var leaks from in-process cron ticker (corroborating #56771) #60350
• Related: [Bug]: execute_code blocked in interactive Telegram gateway session because HERMES_CRON_SESSION env var leaks from cron scheduler into user's shell #56771, HERMES_CRON_SESSION set process-globally: interactive gateway sessions inherit cron approval policy after any cron runs #57736, [Bug]: in-process cron ticker leaks its approval marker into interactive gateway sessions #58662, Follow up: avoid process-wide cron marker leaking into later interactive gateway approvals #59236 (same root cause, different platforms)

[alt-glitch]

This was generated by AI during triage.

Duplicate of #57124 (the earliest open PR adding os.environ.pop("HERMES_CRON_SESSION", None) in run_job()'s finally, Closes #56771). Same code site, same mechanism; the previously-closed #59242 was already consolidated into #57124. Note for the reviewer: this PR also bundles an undisclosed unrelated change — a new _warn_vulnerable_deps() (pip-audit / pip list --outdated) wired into three hermes update output paths in hermes_cli/main.py, which the PR title/description do not mention. If that dependency-audit warning is wanted, it should be split into its own focused PR. Maintainer should pick among the open cron-env cleanups (#57124 / #56796 / #56784).

[webtecnica]

Closing as duplicate — the sweeper identified this as already covered by another PR. Thanks for the contribution!