[Agent] Cron endpoints open when CRON_SECRET unset

Agent brief

Category: security | Severity: medium | Effort: S

Cron routes accept requests when CRON_SECRET unset. Fail closed in production.