refactor(hermes): replace duplicated Hermes CLI parsing with a versioned adapter contract

[jyaunches]

Parent epic: #8004

Problem

agents/hermes/hermes-wrapper.py mirrors private Hermes CLI structure. It carries value-flag tables, boolean flags, top-level flags, a subcommand inventory, provider/model rewriting, profile scanning, and resumed one-shot translation. Docker probes then parse upstream help to prove those duplicated tables still match.

The current checks detect drift, but every upstream CLI change still requires NemoClaw to understand and update private parsing rules.

Desired contract

Replace duplicated parsing with a narrow, versioned adapter contract. The adapter should consume a machine-readable upstream command description when available, or own only the minimal command forms that NemoClaw must translate.

Acceptance criteria

• Document the exact managed command forms that require translation and why passthrough is insufficient.
• Pass through commands that do not require a managed compatibility rule without maintaining a duplicate subcommand inventory.
• Parse each translated command once with a versioned schema or adapter interface.
• Preserve provider/model composition, hidden profile selection, resume/continue semantics, one-shot behavior, and usage-file failure behavior where they are supported.
• Reject an unknown adapter or upstream CLI contract version before invoking a mis-translated command.
• Replace help-text scraping as the primary compatibility authority. Retain help probes only as runtime evidence for the owned public forms.
• Give every retained translation a removal condition and a Hermes-specific acceptance test.
• Make an upstream CLI addition pass through without a NemoClaw release unless it intersects a managed translation.
• Remove duplicated flag tables and subcommand lists after equivalent adapter tests pass.

Delivery and dependencies

This lane can run in parallel with the ownership and canonical-policy work. It does not need to stack on those changes.

If upstream does not expose a machine-readable command schema, first land a narrow internal adapter around the currently supported translations. Do not delay the refactor by designing a general CLI framework.

E2E acceptance

Each PR must follow the PR Review Advisor and E2E contract in #8004.

Minimum live coverage for every behavior-changing PR:

• hermes-e2e
• hermes-inference-switch
• mcp-bridge with the Hermes selector when wrapper routing affects MCP startup or invocation
• channels-stop-start with the Hermes selector when wrapper routing affects channel commands

The live contract must exercise supported passthrough, provider/model selection, named profiles, resume, continue, one-shot, and the guarded usage-file case. Add a dedicated Hermes live target if hermes-e2e does not prove all changed forms. PR Review Advisor can add jobs or targets.

Non-goals

• Do not create a general command parser for hypothetical integrations.
• Do not expose unsupported private upstream flags as NemoClaw contracts.
• Do not silently pass a command through when a managed translation is required for correctness or credential isolation.