Fixes #19701

Summary

• add synchronous pairing-store allowFrom reader for runtime target resolution paths
• enforce allowlisted recipient selection for implicit WhatsApp cron delivery when last-route points to a non-allowlisted chat
• constrain WhatsApp heartbeat recipient resolution to allowlisted recipients when allowFrom exists (configured + pairing-store)
• add focused regression tests for heartbeat recipient filtering and implicit cron reroute behavior

Validation

• pnpm install --frozen-lockfile
• pnpm build
• pnpm check
• pnpm test:macmini

Greptile Summary

This PR enforces allowlisted recipient routing for implicit WhatsApp delivery in cron jobs and heartbeats by merging configured and pairing-store allowFrom entries, preventing scheduled messages from being sent to unauthorized recipients when session history points to non-allowlisted chats.

Key changes:

• Added readChannelAllowFromStoreSync function in pairing-store.ts:354-370 to synchronously read allowFrom entries from both scoped and legacy storage paths
• Modified resolveWhatsAppHeartbeatRecipients in whatsapp-heartbeat.ts:46-94 to merge configured and pairing-store allowFrom lists, then filter session recipients against this merged allowlist before selecting a target
• Updated resolveDeliveryTarget in delivery-target.ts:118-137 to reroute implicit WhatsApp deliveries to the first allowlisted recipient when the session's last target is not in the merged allowFrom list
• Added comprehensive test coverage for both heartbeat recipient filtering and cron delivery rerouting scenarios

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The implementation is well-tested with focused regression tests covering both heartbeat and cron delivery scenarios, follows existing patterns for allowFrom handling, properly handles edge cases (no allowFrom, empty lists, unauthorized recipients), and the synchronous file reading approach is appropriate for the runtime context where these functions are called
• No files require special attention

_{Last reviewed commit: c0ddbab}