6f87575009
Drop the session-only negative (session grants were never consulted on the unattended path, so it pins pre-existing behaviour rather than the fix). Keep the permanent-key positive and the Tirith-not-bypassed negative. Docs: command_allowlist rule keys are honored in cron/-q/unattended sessions.