Greptile Summary

This PR fixes a bug where cron isolated agent runs were missing elevated bash permissions configuration. Previously, bashElevated was not passed to runEmbeddedPiAgent, causing all elevated permission checks to default to disabled mode regardless of the configuration.

Changes:

• Added resolveElevatedPermissions call in src/cron/isolated-agent/run.ts using a cron-event provider context
• Wired the resolved bashElevated object (enabled, allowed, defaultLevel) into runEmbeddedPiAgent calls
• Added regression test verifying bashElevated is properly propagated with correct values

Implementation notes:

• Follows the same pattern used in the main auto-reply flow (get-reply-run.ts)
• Uses cron-event as the provider context for permission resolution
• Correctly extracts elevated defaults from agent config with "off" fallback

Confidence Score: 5/5

• This PR is safe to merge with minimal risk - it's a focused bug fix with appropriate test coverage
• The changes are straightforward and follow established patterns. The implementation correctly mirrors the elevated permissions resolution used in the main auto-reply flow, the test coverage validates the fix, and the scope is minimal (only 2 files changed). No logical errors, security issues, or unintended side effects identified.
• No files require special attention

_{Last reviewed commit: c7186b2}