feat: add Hermes Agent support

[barankavus]

Summary

• add Hermes Agent as a supported coding-agent integration
• delegate Databricks authentication, Gateway discovery, and Hermes configuration to ucode
• generate route-specific Hermes providers for Responses, Anthropic Messages, native Gemini, and OpenAI-compatible model serving
• preserve refreshable Databricks CLI authentication without storing a static bearer token in Hermes configuration
• add receipt validation, conservative managed-configuration ownership, documentation, and integration coverage

Design

Hermes remains a separate client. It invokes ucode configure hermes, validates the returned completion receipt, and consumes the generated named-provider configuration. Authentication, workspace discovery, route construction, and credential refresh remain owned by ucode.

The integration preserves route-family identity and keeps Hermes configuration free of static Databricks bearer tokens.

Validation

• focused test matrix: 1115 passed
• paired Hermes contract E2E: passed
• full suite: 2331 passed, 41 skipped, with 5 failures reproduced on pristine upstream
• Ruff and diff checks: passed
• staged live validation covered setup, all four route families, inference, tool execution, credential refresh, and fresh-process restart
• independent clean-room validation and interactive model selection: passed

Environment note

A local enterprise-CA verification issue was reproduced unchanged with both the pre-change and post-change ucode clients. This contribution does not modify TLS or certificate handling.

Scope

This PR does not change generic TLS behavior, dependency resolution, installer behavior, workflows, or the ucode lockfile.