fix(multiplex): per-profile cron scope, credential isolation, and per-chat-id rate limiting

[soddy022]

Summary

Fixes the get_secret('OPENAI_API_KEY') called with no profile secret scope active while multiplexing is on crash that kills cron jobs in multiplexed deployments (#Workstream A).

Root Cause

When multiplex_profiles is enabled, get_secret() requires an active profile_runtime_scope. The cron scheduler was missing this, so agent-mode cron jobs from non-default profiles crashed before generating any content (#8446d44c7a67, #c6dc075ef4b4).

Changes

1. agent/profile_scope.py (new)

Shared context manager used by both the gateway inbound path and the cron scheduler — breaks the natural gateway → cron import cycle.

2. cron/scheduler.py

Wraps run_one_job in profile_runtime_scope when multiplexing is active. Adds helpers:

• _is_multiplex_active() — gate on whether to enter the scope
• _parse_delivery_chat_id() — extract chat_id from deliver string
• _resolve_target_profile_home() — 4-tier resolution (explicit path → profile name → chat_id scan → root)

3. gateway/config.py

Replaces os.getenv("WEIXIN_TOKEN") / os.getenv("WEIXIN_ACCOUNT_ID") with get_secret() — ensures each multiplexed profile reads its own token, not the process-global env.

4. gateway/platforms/weixin.py

Per-chat-id rate limit isolation:

• _rate_limit_circuit_until and _rate_limit_events changed from scalar to defaultdict[str, ...]
• New _expire_rate_limit_circuit(chat_id) self-heal method — clears expired breakers without needing a successful send
• All rate-limit methods now take chat_id parameter

5. tests/cron/test_cron_multiplex_profile_scope.py (new)

Regression tests covering profile scope resolution, credential isolation, and per-chat-id rate limiting.

Design Doc

See docs/design/multiplexing-gateway.md (Workstream A) for architectural rationale.