feat(agent): add Hermes as a first-class CLI

[Anton-Horn]

Summary

• register Hermes throughout the terminal-agent, review, settings, skills, session, and logo surfaces
• install a profile-scoped managed Hermes plugin on the runtime host for lifecycle, permission, context, and edit hooks
• persist profile-aware sessions and resume the exact Hermes profile safely
• guard overlapping processes and stale finalizers from clearing newer session state
• add synthetic coverage plus opt-in live tests against the real Hermes CLI

This is implemented directly on current main. It expands the narrower restoration approach from #691 into a complete first-class CLI integration.

Verification

• npm run typecheck
• npm run build
• npm run build:runtime
• full Vitest suite: 3,914 passed, 1 expected failure, 1 skipped
• Hermes 0.21.3 plugin doctor: 8 hooks registered
• live OpenRouter contract with DeepSeek V4.1 Flash: context delivery, lifecycle, native patch capture, privacy filtering, and profile identity
• real PTY launch contract: hermes chat -q remains interactive after the seeded turn
• targeted ESLint and git diff --check