refactor(canvas): remove RUNTIME_PROFILES.hermes — value flows server-side (#2054 phase 3)

[HongmingWang-Rabbit]

[Molecule-Platform-Evolvement-Manager]

Final canvas-side cleanup for #2054. The hardcoded `RUNTIME_PROFILES.hermes = 720_000ms` entry is redundant now that the value flows from the template manifest through workspace-server to the canvas socket payload.

End-state flow for hermes

1. `template-hermes config.yaml` declares `runtime_config.provision_timeout_seconds: 720` (template PR)
2. `workspace-server` reads it at request time (#2094 MERGED)
3. Workspace API response includes `provision_timeout_ms: 720000`
4. Canvas `hydrate` populates `node.data.provisionTimeoutMs` (#2092 MERGED)
5. `ProvisioningTimeout` resolver picks it up via overrides

Same effective 720s threshold, now declarative and one-edit-point per runtime.

Changes

• `canvas/src/lib/runtimeProfiles.ts` — `RUNTIME_PROFILES.hermes` deleted, jsdoc explains the empty-map-by-design + new-runtime guidance
• `canvas/src/components/tests/ProvisioningTimeout.test.tsx` — 3 tests updated to assert post-cleanup state (hermes returns default, profile is undefined)

Tests

19/19 pass. The deleted hermes override is replaced by an assertion that `RUNTIME_PROFILES.hermes` is `undefined` — locks in the post-cleanup state so a future re-add gets caught.

Test plan

• CI green
• After merge + workspace-server picks up the template change: confirm a fresh hermes workspace's `provision_timeout_ms` field is 720000 in the API response
• Confirm canvas ProvisioningTimeout still uses 12-min threshold for hermes via the server-declared path (not the now-deleted RUNTIME_PROFILES.hermes)
• No regression on other runtimes (claude-code/langgraph/crewai still get 2-min default)

Related PRs in this chain

• template PR #23 — declares the field
• #2094 — workspace-server reads + surfaces (MERGED)
• #2092 — canvas plumbing (MERGED)

[HongmingWang-Rabbit]

Reviewed across all five axes — logical approve (clean phase-3 cleanup, post-merge state matches the documented end-state flow), but Canvas tabs E2E is failing.

Skip — failing CI: Canvas tabs E2E reports tenant TLS: timed out after 180s followed by [staging-teardown] no state file — setup must have failed before org create. This is a staging-environment issue (TLS provisioning didn't complete in the 3-min budget), not a regression introduced by this PR — the diff only touches canvas/src/lib/runtimeProfiles.ts (deletes a const) and one test file. Canvas (Next.js) unit suite is green.

A retry or staging-side fix should clear this. Not arming auto-merge here per the review rules — please re-run the E2E job (or wait for the staging tenant-provisioning path to recover) and ping back if it still fails after that.

Logical review notes for when CI clears:

• Three-phase chain looks complete: template repo declares → workspace-server surfaces → canvas plumbs → canvas-side hardcoded fallback removed.
• Tests asserting RUNTIME_PROFILES.hermes is undefined post-cleanup is the right shape — locks in the migration so a future re-add gets caught immediately.
• No concerns on correctness / readability / architecture / security / performance.

[HongmingWang-Rabbit]

Status update: Canvas tabs E2E retried at 15:47Z after #2099 (TLS timeout 3min→10min) merged at 15:27Z. The TLS timeout symptom is gone, but the suite now fails at a different point:

Error: tenant-token fetch 404: {"error":"org not found"}

This is a separate staging-orchestration issue, not anything this PR's diff introduced. The test creates an org via POST /cp/orgs and then fetches its admin token; the fetch is 404'ing — likely a CP-side persistence race, or a slug-mismatch between create and fetch.

Still skipping merge per the review rules — this is the same skip reason (failing E2E, environmental) but a fresh root cause. Suggest filing a separate issue for the org-create→token-fetch 404 once it's been reproduced enough to characterize, then re-run E2E on this PR.

[HongmingWang-Rabbit]

Skipping review this pass: required check Canvas tabs E2E still failing — tenant TLS: timed out after 900s. Same infrastructure symptom as #2108/#2064 in this window (Cloudflare/cloudflared propagation flake, not PR code). Will re-evaluate when staging infra is healthy.

[HongmingWang-Rabbit]

Re-triggered failed CI (CP #284 just merged at 21:49Z, fixing the silent-DNS-failure root cause that was stranding tests at tenant TLS / DNS propagation timed out). Re-evaluate once the new run completes.