feat: register plugin middleware declaratively

[offendingcommit]

Summary

Plugins can now declare behavior-changing Hermes middleware through the same lifecycle registration used for commands, tools, hooks, and skills. The public contract covers all four current request and execution phases, remains forward-compatible with future string kinds, and preserves the existing tool-only register_all path.

Request middleware can replace the effective tool or model payload before Hermes continues. Execution middleware wraps the real call through Hermes' single-use next_call, while the kit rejects async callbacks and duplicate phase declarations before registration and keeps payloads out of its instrumentation logs.

Validation

• make test passes all 66 tests, including registration, privacy-safe failure logging, duplicate preflight, and the real hermes-agent middleware helpers for all four phases.
• make build produces the 0.5.0 source distribution and wheel.

New concepts

Observer hooks versus middleware

Hooks report what happened, while middleware participates in what happens. A request callback can replace the payload that downstream policy and execution see; an execution callback controls when and how the real operation is invoked.

flowchart LR
    A["Original request"] --> B["Request middleware"]
    B --> C["Hooks, guardrails, and approvals"]
    C --> D["Execution middleware"]
    D --> E["Real tool or model call"]
    E --> D

Loading

This separation keeps observation passive and makes behavioral changes explicit. Use hooks for telemetry or contextual side effects; use middleware only when the plugin must rewrite an input, wrap execution, or transform a result. An execution callback must never call next_call twice because that would repeat the underlying operation.