fix(cron): keep scheduler jobs outside child context

[TheNewBee]

Summary

• prevent tick() from propagating a delegated-child ContextVar into scheduler-owned cron jobs
• preserve the hard child-process environment marker guard
• add a regression test covering a delegated caller firing a cron parent

Verification

• python3 -m pytest -q tests/cron/test_run_one_job.py (4 passed)
• python3 -m py_compile agent/delegation_context.py cron/scheduler.py
• git diff --check

This fixes PM cron Kanban closure being denied solely because contextvars.copy_context() carried a surrounding delegate_task child marker into the scheduler worker.

[teknium1]

Thanks for investigating the ContextVar boundary. The scheduler does copy the caller context at cron/scheduler.py:4236-4240, so the proposed reset would take effect.

Problems

• I could not verify the claimed production trigger. The gateway starts the scheduler in its own cron-scheduler thread at gateway/run.py:25535-25542; the provider calls cron_tick from its ticker loop at cron/scheduler_provider.py:225-237. The desktop path similarly starts desktop-cron-ticker at hermes_cli/web_server.py:211-219.
• The regression test directly calls s.tick() inside delegated_child_context(). Delegated children are explicitly denied cronjob at tools/delegate_tool.py:47-54 and receive that disabled toolset at tools/delegate_tool.py:1303-1306, so this does not demonstrate a normal cron firing path.

Suggested changes

• Please identify and test a first-party production path that enters tick() with the delegated-child marker set. Without one, this bypass weakens the Kanban mutation boundary without a verified affected path.

This is an automated hermes-sweeper review.

[TheNewBee]

You are right. I cannot identify a first-party production path that enters scheduler tick() with the delegated-child marker set. The added test directly invoked tick() inside delegated_child_context(), so it does not establish the reported production trigger. I am closing this instead of weakening the scheduler authority boundary; a future report will need a real production-path reproduction before reopening.