fix: require positive signal in _is_unattended_context (Closes #1554)

[Lexus2016]

Automated evolution PR for issue #1554.

Problem

PR #1550 (suppress pending_approval retries in cron/subagent contexts, #1542) has CI failures on test slices 2/8 and 8/8. Root cause: _is_unattended_context() returns True whenever there's no interactive CLI, no gateway, and no cron session — a catch-all "nobody's home" default. In the CI test environment (non-interactive, non-gateway, non-cron), this evaluates to True, causing check_all_command_guards and check_execute_code_guard to return blocked instead of pending_approval. Existing tests expecting pending_approval behavior break.

Fix

Make _is_unattended_context() require a positive signal (HERMES_CRON_SESSION or HERMES_SUBAGENT) instead of the catch-all default. This preserves the #1542 fix for actual cron/subagent sessions while not affecting tests or interactive sessions.

def _is_unattended_context() -> bool:
    if env_var_enabled("HERMES_CRON_SESSION"):
        return True
    if env_var_enabled("HERMES_SUBAGENT"):
        return True
    return False

Files

• tools/approval.py — _is_unattended_context() + _cron_blocked_result() + 2 call sites
• tests/tools/test_approval_cron_block.py — 8 tests (updated test_no_context_not_unattended to expect False)

Checks

• lint ✓ (ruff check)
• targeted tests ✓ (8/8 passed)

Closes #1554

[Lexus2016]

Closing: superseded by #1556. Code-review found #1555 ships dead code — its subagent detection relies on HERMES_SUBAGENT, an env var that does NOT exist on main (verified: git show origin/main:tools/approval.py → 0 matches). That branch can never fire in production, so only the cron half of the fix would work. #1556 takes the correct approach (a contextvars.ContextVar _hermes_subagent_ctx, set in delegate_tool._run_single_child, mirroring the existing _hermes_interactive_ctx pattern). #1556 passed code review but is blocked by the autonomous merge gate (touches tools/approval.py = HIGH_RISK_PATH + 236 lines > 200 cap) and needs a human merge. Issue #1554 stays accepted — #1556 is the valid fix, awaiting human review.