fix(acp): reject unadvertised auth methods

[zhao0112]

Summary

• validate method_id against the runtime provider advertised during ACP initialization
• keep authentication behavior unchanged when the requested method matches the configured provider
• add a regression test covering a mismatched method_id

Fixes #13452

Root Cause

HermesACPAgent.initialize() advertises a single auth method derived from detect_provider(), but authenticate() previously ignored the requested method_id and returned success whenever any provider was configured. That allowed clients to authenticate with method ids the server never advertised.

Validation

• PYTHONPATH=/Users/zzl/.hermes/hermes-agent-pr-13452 /Users/zzl/.hermes/hermes-agent-update-20260421/venv/bin/python -m pytest -o addopts= tests/acp/test_server.py -q
• PYTHONPATH=/Users/zzl/.hermes/hermes-agent-pr-13452 /Users/zzl/.hermes/hermes-agent-update-20260421/venv/bin/python -m py_compile acp_adapter/server.py tests/acp/test_server.py
• git diff --check

[alt-glitch]

Likely duplicate of #13468 (merged) — same fix validating method_id against the advertised provider in ACP authenticate().

[alt-glitch]

Likely duplicate of #13468 (merged) — same fix validating method_id against the advertised provider in ACP authenticate().

[teknium1]

Thanks for the contribution @zhao0112! This fix was already shipped in #13468 (merged 2026-04-21), which applies the same correction — authenticate() now validates method_id case-insensitively against the advertised provider and returns None on mismatch.

This is an automated hermes-sweeper review.

Evidence:

• Commit c6974043e — refactor(acp): validate method_id against advertised provider in authenticate() — landed the identical fix.
• acp_adapter/server.py lines 363–373: method_id.strip().lower() != provider guard is already live on main.
• @alt-glitch independently flagged this as a duplicate of refactor(acp): validate method_id against advertised provider in authenticate() #13468 in the PR comments.

Closing as duplicate — the underlying issue (#13452) is resolved.