fix(hosted/orchestration): scope turn origin for local-agent spawn so cron tools aren't denied - #5527

The PR description accurately and completely describes the diff. The title and body explain the bug (task-local AGENT_TURN_ORIGIN not crossing tokio::spawn at the residual effect_executor.rs spawn site), the fix (wrapping the spawned future in with_origin(AgentTurnOrigin::Cli, ...)), and the accompanying gate-message rewrite. The diff contains exactly those changes plus the tests the checklist claims were added — the turn_origin.rs explicit-Cli-origin test and the gate.rs cron_add-on-turnless-spawn regression test, both spanning a real spawn boundary — and updates the two existing deny-message assertions to the new copy. No unmentioned significant changes, no mismatches. The code index for this repository is cold, so this review saw the diff alone.

No findings.