fix: cron tool fails with 'pairing required' on headless gateway

[tenequm]

Problem

The cron tool fails on AgentBox VMs with gateway closed (1008): pairing required. This breaks scheduled tasks (e.g. auto-monitoring trade positions via prompt.fun).

Error from session logs (puppyboy instance):

{
  "status": "error",
  "tool": "cron",
  "error": "gateway closed (1008): pairing required\nGateway target: ws://127.0.0.1:18789\nSource: local loopback\nConfig: /home/openclaw/.openclaw/openclaw.json\nBind: loopback"
}

Root Cause

AgentBox starts the gateway with openclaw gateway run (not gateway install), so no device pairing is ever created. paired.json is empty {}.

• HTTP chat completions work fine without device pairing
• But the cron tool creates an internal WebSocket connection to ws://127.0.0.1:18789
• That connection hits the device pairing check with no paired device
• dangerouslyDisableDeviceAuth: true only covers the Control UI path, not general WebSocket connections used by cron/announce

Upstream Context

This is a known OpenClaw bug cluster with 10+ issues:

• openclaw/openclaw#21655 - exact bug: internal gateway ops (cron, announce, sessions_spawn) fail with "pairing required" due to device scope enforcement on self-calls
• openclaw/openclaw#31804 - same bug, labeled regression
• openclaw/openclaw#25344 - paired users not recognized as owners for ownerOnly tools (cron, gateway)

Upstream PRs:

• PR #23125 - Merged: operator.admin satisfies operator.write - doesn't help us since paired.json is empty (no device paired at all)
• PR #23277 - Open: root cause fix that preserves scopes for localhost token-auth without device identity. Would fix our exact case. Actively maintained (last rebased Mar 8), Greptile 4/5 confidence.
• PR #23652 - Closed (not merged): auto-approve scope upgrades for loopback clients

Options

A. Workaround in init script (image rebuild)
After gateway starts, approve the self-pairing:

sudo -u openclaw openclaw devices approve --latest 2>/dev/null || true

B. Wait for upstream PR #23277
When merged and released, updating OpenClaw on the image fixes cron automatically.

C. Manual paired.json setup in init script
Write device scopes including operator.write to paired.json before starting the gateway.

Impact

• Cron tool is completely broken on all AgentBox VMs
• Agents cannot schedule recurring tasks (trade monitors, heartbeats, auto-updates)
• Chat completions and all other functionality are unaffected
• Surfaced by prompt.fun user requesting auto-updates on trade positions