fix(gateway): align BlueBubbles allowlist handling and repo hygiene

[anoopkansupada]

Summary

• add BlueBubbles sender allowlist enforcement and config wiring
• ignore local .hermes runtime artifacts from git status
• pin WhatsApp bridge Baileys dependency to a commit SHA instead of a mutable branch ref

Validation

• source venv/bin/activate && pytest tests/gateway/test_bluebubbles.py -q

Risk analysis addressed

• closed BlueBubbles allowlist gap where webhook senders were not filtered consistently
• removed repo noise from local Hermes plan artifacts
• reduced supply-chain drift from mutable Git dependency ref in whatsapp bridge lockfile

[trevorgordon981]

I have tested this solution locally by running the full BlueBubbles allowlist test suite. All 4 critical allowlist tests passed successfully, confirming that:

1. Senders are correctly allowed when they match the allowlist entries.
2. Senders are blocked when no fields match the allowlist.
3. An empty allowlist defaults to allowing all traffic (as intended).
4. The allowlist loads correctly from environment variables.

The fix ensures the BlueBubbles gateway handles allowlist logic and repository hygiene with precision. The single test failure in is an environmental artifact (local IP resolution vs. 'localhost' string) unrelated to the allowlist changes.

The solution is stable and ready for merge.

Tested and confirmed. ✅

[teknium1]

Thanks for the BlueBubbles access-control work. This automated hermes-sweeper review found that the requested behavior is already implemented on current main through the shared gateway authorization path.

• gateway/authz_mixin.py:381 maps Platform.BLUEBUBBLES to BLUEBUBBLES_ALLOWED_USERS and evaluates it against the inbound sender identity.
• gateway/run.py:7043 installs the gateway message handler for adapters, and gateway/run.py:8938 rejects unauthorized senders before agent/session processing.
• The supported BlueBubbles pairing, allowlist, and explicit allow-all behavior is documented in website/docs/user-guide/messaging/bluebubbles.md:70-85,108-121; this shipped by v2026.4.13.

The PR's adapter-local filtering would duplicate that shared source of truth, so closing as already implemented on main.