Context

Heartbeat has binary either/or logic: if ANY agent has explicit heartbeat config, ONLY those get heartbeat; otherwise ONLY the default agent gets heartbeat. Cron's resolveCronAgent() silently falls back when specified agent not in config — a typo in agentId: "helpr" runs as default agent.

Depends on #1575 (sole-agent auto-selection).

What

Heartbeat

1. Rewrite isHeartbeatEnabledForAgent() — agents.defaults.heartbeat applies to ALL agents as baseline
2. Per-agent heartbeat config overrides the defaults
3. No agents → skip heartbeat entirely

Cron

4. resolveCronAgent() must throw/warn when specified agent not in config
5. assertMainSessionAgentId() uses sole-agent logic instead of default-agent
6. Session reaper uses explicit agent from job, not default fallback

Acceptance Criteria

• agents.defaults.heartbeat configured → ALL agents get heartbeat (not just default)
• Per-agent heartbeat overrides defaults for that agent
• Cron job with unknown agentId → error/warning (not silent fallback)
• assertMainSessionAgentId() validates against sole agent
• Session reaper uses explicit agent from job
• Tests updated; CI passes

Files

• src/infra/heartbeat-runner.ts (6 call sites)
• src/gateway/server-cron.ts — resolveCronAgent at line 165, plus standalone call at line 223 (2 production call sites total)
• src/cron/service/jobs.ts (assertMainSessionAgentId)
• src/cron/service/timer.ts (session reaper)
• src/cron/isolated-agent/run.ts (three-level cascade)