Add Hermes compatibility checks

[awxxxxxx]

Summary

Adds repo-local GitHub Actions coverage for the mem9 Hermes plugin so plugin changes are tested before the main mem9 cross-agent compatibility workflow runs.

This PR covers the plugin-upgrade side. The main mem9 PR now uses plugin_ref to checkout this repo at a branch/tag/SHA and run the same contract suite, and uses host_ref separately when validating Hermes Agent upgrades.

What changed

• Adds .github/workflows/compat-checks.yml.
• Runs the existing Hermes provider pytest suite on pull requests, pushes to main, and manual dispatch.
• Checks shell script syntax for install.sh and scripts/link-memory-provider.sh.

How this relates to mem9 main

The main mem9 repo PR adds:

python3 compat agent hermes --lane plugin-contract --plugin-ref <this-repo-branch-or-tag>
python3 compat agent hermes --lane host-smoke --host-ref <hermes-agent-branch-or-tag>

So:

• Hermes plugin upgrades use lane=plugin-contract plus plugin_ref.
• Hermes Agent upgrades use lane=host-smoke plus host_ref.
• The two refs are intentionally separate so we can identify whether a break came from the plugin or the host.

GitHub Action usage from mem9 main

Plugin upgrade check:

agent: hermes
lane: plugin-contract
plugin_ref: <this PR branch/tag/SHA>
host_ref: <empty>
plugin_source: manifest

Hermes Agent upgrade check:

agent: hermes
lane: host-smoke
plugin_ref: <empty or plugin candidate>
host_ref: <hermes-agent branch/tag/SHA>
plugin_source: manifest

Hermes host-smoke requires this secret in the main mem9 repo:

MNEMO_BASE_URL=<hosted-dev-api-base-url>

Verified locally

python3 -m venv /tmp/mem9-hermes-ci-venv
/tmp/mem9-hermes-ci-venv/bin/python -m pip install --disable-pip-version-check pytest httpx
/tmp/mem9-hermes-ci-venv/bin/python -m pytest -q tests/test_mem9.py
bash -n install.sh scripts/link-memory-provider.sh

Result: 103 passed.