fix(cron): isolate approval state per session

[DOUIF]

Summary

• replace process-global HERMES_CRON_SESSION mutation with session-local ContextVar state
• preserve environment fallback for standalone/legacy cron invocations
• add regression coverage proving cron state is cleaned up and does not leak into normal gateway turns

Root cause

The gateway scheduler and normal Telegram/API turns share one process. Setting os.environ["HERMES_CRON_SESSION"] = "1" inside a job permanently changes process-global state, so later non-cron turns and MCP children inherit cron approval behavior.

Verification

pytest -q tests/cron tests/tools/test_cron_context_isolation.py tests/tools/test_cron_approval_mode.py tests/tools/test_local_env_session_leak.py tests/gateway/test_session_context_inheritance.py
794 passed, 1 pre-existing RuntimeWarning

[alt-glitch]

This was generated by AI during triage.

Duplicate of #58663: both use a job-local ContextVar to replace the process-global cron marker. #58663 additionally covers stale-env masking for interactive gateway turns and inherited ask-mode behavior.

[teknium1]

Thanks for isolating cron provenance from the gateway process; the current-main leak is real (cron/scheduler.py:3014 and tools/approval.py:241).

Problems

• gateway/session_context.py:244 adds _CRON_SESSION to clear_session_vars(), which writes "". get_session_env() returns any non-_UNSET ContextVar value without consulting os.environ (gateway/session_context.py:325-331). After run_job() calls its finally cleanup (cron/scheduler.py:3765), a later standalone/legacy HERMES_CRON_SESSION=1 path in that context is misclassified as non-cron and can bypass cron_mode: deny.

Suggested changes

• Bind the cron marker directly in run_job() and retain its ContextVar token; reset that token in the finally block after generic session cleanup. This restores the pre-job _UNSET state and preserves the documented environment fallback.
• Add a real run_job()-then-env-fallback regression. Open duplicate #58663 already carries this token-reset pattern and broader stale-environment coverage.

Automated hermes-sweeper review.

[teknium1]

Adding this marker to the generic clear list makes clear_session_vars() set it to "". get_session_env() treats that explicit empty value as authoritative, so a later legacy HERMES_CRON_SESSION=1 environment fallback in the same context is ignored. Keep a token from the job-local marker binding and reset it in run_job()'s finally instead.