fix(cron): persist explicit scheduled tool authority (#112483)

* fix(cron): persist explicit scheduled tool authority

* test(cron): cover explicit scheduled authority

* fix(cron): preserve legacy authority on routine edits

* test(cron): add explicit authority e2e matrix

* test(cron): harden explicit authority live proof

src/cli/cron-cli/register.cron-edit-options.ts

@@ -194,7 +194,9 @@ export async function resolveCronEditPayloadDeliveryPatch(
     assignIf(payload, "timeoutSeconds", timeoutSeconds, hasTimeoutSeconds);
     assignIf(payload, "lightContext", opts.lightContext, typeof opts.lightContext === "boolean");
     if (opts.clearTools) {
-      payload.toolsAllow = null;
+      // Clearing a restriction means an explicit unrestricted grant. Persisting
+      // a wildcard avoids creating a new capless legacy job at the upgrade boundary.
+      payload.toolsAllow = ["*"];
     } else if (toolsAllow) {
       payload.toolsAllow = toolsAllow;
     }

src/cli/cron-cli/register.cron-edit.test.ts

@@ -323,6 +323,26 @@ describe("cron edit command", () => {
     );
   });
 
+  it("stores an explicit wildcard with --clear-tools", async () => {
+    const program = createCronProgram();
+
+    await program.parseAsync(["edit", "job-1", "--clear-tools"], { from: "user" });
+
+    expect(callGatewayFromCli).toHaveBeenCalledWith(
+      "cron.update",
+      expect.objectContaining({ clearTools: true }),
+      {
+        id: "job-1",
+        patch: {
+          payload: {
+            kind: "agentTurn",
+            toolsAllow: ["*"],
+          },
+        },
+      },
+    );
+  });
+
   it("clears the thinking override with --clear-thinking (CLI parity with cron.update thinking:null)", async () => {
     const program = createCronProgram();