Bug

When a cron job has payload.model set to a specific model (e.g., anthropic/claude-sonnet-4-6), and that model is removed from the allowed models list or becomes unavailable, the cron executor hard-fails with model not allowed instead of falling back to the agent's default model chain.

Impact

All cron jobs (heartbeats, scheduled tasks, monitors) that specify payload.model will fail simultaneously if that model is removed from the config, even when the agent has a perfectly good fallback chain configured via agents.defaults.model.fallbacks.

This caused a cascading failure where all 4 heartbeats + forum monitor failed with 8-11 consecutive errors each after a model was removed from the allowed list.

Expected Behavior

When payload.model fails resolveAllowedModelRef(), the cron executor should:

1. Log a warning: cron: payload.model '{model}' not allowed, falling back to agent defaults
2. Fall through to use the agent's default model (which has its own fallback chain)
3. Continue executing the job normally

Current Behavior

resolveAllowedModelRef() returns an error → cron executor immediately returns { ok: false, error: 'model not allowed: ...' } → job fails → no fallback attempted.

Relevant Code

src/cron/isolated-agent/run.ts around line 190 — the model override resolution block.

Fix

PR #26717