Bug Description

sessions_list returns the agent's default model for cron/isolated sessions, even when the cron job specifies a different payload.model. This is misleading for cost analysis.

Steps to Reproduce

1. Configure a cron job with agentId: "main" (default model: claude-opus-4-6) and payload.model: "google-gemini-cli/gemini-3-flash-preview"
2. Let the cron job run
3. Call sessions_list and check the session's model field

Expected Behavior

sessions_list should show the actual runtime model (gemini-3-flash-preview) — either the model from payload.model or the last model_change event in the transcript.

Actual Behavior

sessions_list shows claude-opus-4-6 (the agent's default model), even though the transcript confirms the session ran on gemini-3-flash-preview (with model_change event and usage.cost.total=0).

Impact

When analyzing token costs across sessions, this makes it appear that expensive Opus tokens are being consumed by cron jobs that are actually running on free Flash models. This caused a false alarm during our cost audit today.

Environment

• OpenClaw version: 2026.2.17 (build 4134875)
• Cron config: sessionTarget: "isolated", payload.model: "google-gemini-cli/gemini-3-flash-preview"
• Agent default model: claude-opus-4-6