fix(mcp): let embedding hosts pin the process home for routed-profile detection

[karangehlod]

What does this PR do?

Fixes all four launch-home decisions that flip when an embedding host mirrors the active turn's profile into `os.environ["HERMES_HOME"]` per turn (confirmed broken on main @ a27b130, #119242):

Decision	Broken without fix	Fixed by
`serves_routed_profile()`	MCP connections fall back to bare cross-profile names	`get_process_hermes_home()` returns pinned value
`_is_routed_home()`	`strip_launch_profile_env` leaves launch residue in child env	same
`_is_process_home()`	`GATEWAY_ALLOW_ALL_USERS` grant seeded into served scope	same
`env_loader._process_hermes_home()`	terminal.* config bridges into shared process env	same

Root cause. All four decisions call `get_process_hermes_home()`, which reads `HERMES_HOME` live. When the host mirrors the served home there, all four flip.

Fix. `get_process_hermes_home()` now returns a pinned value when one is set, so every caller is fixed at once without touching their call sites. The pin is set by:

• `pin_process_hermes_home(launch_home)` — explicit, for embedding hosts (first call wins; `None` clears).
• `set_multiplex_active(True)` — auto-pins the current `get_process_hermes_home()` value so multiplexed gateways are covered with no extra calls.

Standalone invocations (no multiplex, no explicit pin) keep following `HERMES_HOME` exactly as before.

Related Issue

Fixes #119242.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• `hermes_constants.py`: add `_PINNED_PROCESS_HERMES_HOME` (module-level, `None` by default), `pin_process_hermes_home(path | None)` (first-pin-wins, `None` clears), and move the pin check into `get_process_hermes_home()` itself. `get_routing_process_hermes_home()` kept as a backward-compat alias.
• `agent/secret_scope.py`: `set_multiplex_active(True)` auto-pins via `pin_process_hermes_home(get_process_hermes_home())`; `serves_routed_profile()` reverted to use `get_process_hermes_home()` (now pin-aware).
• `tests/agent/test_serves_routed_profile_pin.py` (new, 9 tests): unpinned semantics unchanged; pin survives mirrored env; first-pin-wins; multiplex auto-pin; explicit-pin-before-multiplex; and the three previously-broken decisions (`_is_routed_home`, `_is_process_home`, `env_loader._process_hermes_home`).

How to Test

pytest tests/agent/test_serves_routed_profile_pin.py -q
# 9 passed (all fail on main without this change)

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs — not a duplicate
• My PR contains only changes related to this fix
• I've added tests for my changes

Documentation & Housekeeping

• Docstrings updated on `pin_process_hermes_home`, `get_process_hermes_home`, `set_multiplex_active`
• Cross-platform: pure path comparison through existing `_expand_hermes_home`; no OS-specific code
• `cli-config.yaml.example` — N/A (no config key added)