fix(cron): isolate cron approval context

[seungjins]

Summary

• keep cron execution identity in per-task ContextVars instead of process-global environment state
• prevent stale cron flags from poisoning live gateway approval decisions
• preserve cron fail-closed approval behavior while live gateway approvals remain interactive

This is a current-main re-derivation of the intent in #36004, whose original fork branch is no longer writable by the submitting account and has become conflicting.

Verification

• pytest tests/gateway/test_session_env.py tests/tools/test_execute_code_approval_cluster.py tests/tools/test_cron_approval_mode.py tests/cron/test_cron_script.py tests/cron/test_scheduler.py -q
• 333 passed (3 pre-existing runtime/deprecation warnings)

[alt-glitch]

This was generated by AI during triage.

Duplicate of #58663: both implement the same ContextVar-based cron approval isolation. #58663 is the more complete current patch because it resets the ContextVar token in finally, preserving the standalone environment fallback.

[seungjins]

Closing as duplicate of #58663, which contains the same ContextVar isolation plus the stronger token-reset/fallback coverage and has a green required-check suite.