Agent self-scheduling via crontab gets classifier-blocked; hand user a paste

Building a proactive assistant (scheduled headless claude -p digests), the auto-mode permission classifier blocked both crontab install AND even writing the crontab content to a file — agent self-persistence is treated as a hard no. Correct pattern: prepare the exact one-paste install block in chat and let the user run it themselves. Related useful bits: scope headless runs with --allowedTools to read-only MCP tools so the cron job physically cannot send email; get the user's own WhatsApp JID for a self-chat delivery channel from the whatsmeow_device table in the bridge sqlite; track subscription burn from inside sessions with npx -y ccusage daily (reads local transcripts, no browser needed).