hermes - 💡(How to fix) Fix test: approval_isolation test fails when HERMES_CRON_SESSION=1 in parent env

Bug Description

The test test_interactive_env_var_routes_to_callback in tests/acp/test_approval_isolation.py fails intermittently when HERMES_CRON_SESSION=1 is set in the parent process environment.

Steps to Reproduce

1. Run the test in an environment where HERMES_CRON_SESSION=1 is set (e.g., a cron session or a session spawned by the cron scheduler)
2. The test deletes HERMES_INTERACTIVE, HERMES_GATEWAY_SESSION, HERMES_EXEC_ASK, and HERMES_YOLO_MODE but NOT HERMES_CRON_SESSION
3. The command rm -rf /tmp/test-exec-ask is flagged as dangerous ("delete in root path")
4. The cron deny mode kicks in and blocks the command
5. Test expects approved=True but gets approved=False

Expected Behavior

The test should fully isolate its environment by cleaning up HERMES_CRON_SESSION alongside the other env vars it already cleans.

Actual Behavior

The test passes in a clean environment but fails when HERMES_CRON_SESSION leaks from the parent process.

Root Cause

In tools/approval.py line 1090-1104, when HERMES_CRON_SESSION is set and the command is flagged as dangerous, the cron deny mode blocks execution before the non-interactive auto-approve path at line 1105 can fire.

Fix

Add monkeypatch.delenv("HERMES_CRON_SESSION", raising=False) to the test's env cleanup (line 215 of tests/acp/test_approval_isolation.py).