test(e2e): migrate test-hermes-sandbox-secret-boundary.sh to vitest

.github/workflows/e2e-vitest-scenarios.yaml

@@ -639,6 +639,50 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+  hermes-sandbox-secret-boundary-vitest:
+    needs: generate-matrix
+    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',hermes-sandbox-secret-boundary-vitest,') || contains(format(',{0},', inputs.scenarios), ',hermes-sandbox-secret-boundary,') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      FREE_STANDING_VITEST_JOB: "1"
+      FREE_STANDING_SCENARIO_ID: "hermes-sandbox-secret-boundary"
+      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/hermes-sandbox-secret-boundary
+      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install root dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Run Hermes sandbox secret-boundary live test
+        # Migrated from test/e2e/test-hermes-sandbox-secret-boundary.sh. This
+        # builds the real Hermes images unless prebuilt NEMOCLAW_HERMES_* image
+        # env vars are supplied, then probes image and startup secret boundaries.
+        run: |
+          set -euo pipefail
+          npx vitest run --project e2e-scenarios-live \
+            test/e2e-scenario/live/hermes-sandbox-secret-boundary.test.ts \
+            --silent=false --reporter=default
+
+      - name: Upload Hermes sandbox secret-boundary artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-vitest-scenarios-hermes-sandbox-secret-boundary
+          path: e2e-artifacts/vitest/hermes-sandbox-secret-boundary/
+          include-hidden-files: false
+          if-no-files-found: ignore
+          retention-days: 14
+
   inference-routing-vitest:
     needs: generate-matrix
     if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',inference-routing-vitest,') || contains(format(',{0},', inputs.scenarios), ',inference-routing,') }}
@@ -4802,6 +4846,7 @@ jobs:
         runtime-overrides-vitest,
         hermes-e2e-vitest,
         hermes-root-entrypoint-smoke-vitest,
+        hermes-sandbox-secret-boundary-vitest,
         network-policy-vitest,
         common-egress-agent-vitest,
         shields-config-vitest,