feat(providers): add Google Vertex AI as a first-class inference provider

[Zephyr596]

What does this PR do?

Adds Google Vertex AI as a first-class inference provider for Gemini models, using GCP's OpenAI-compatible endpoint with dynamic OAuth2 token resolution. This is similar in intent to #8427 but addresses several correctness and UX issues found during implementation and testing.

Issues corrected vs #8427:

• Adds hermes_cli/vertex_adapter.py (not just agent/vertex_adapter.py) so the CLI credential path is fully decoupled from the agent subsystem
• Adds a dedicated _model_flow_vertex() in main.py — the generic _model_flow_api_key_provider() was misidentifying the service account JSON path as an "API key" and unconditionally prompting for a "Base URL" that is dynamically computed and should not be manually entered
• Fixes validate_requested_model() to strip the mandatory google/ publisher prefix before catalog lookup, preventing a false "model not found in curated catalog" warning on every session start
• Model catalog restricted to official stable chat models only (gemini-2.5-pro/flash/flash-lite, gemini-2.0-flash-001/flash-lite-001) — no preview/audio/image/embedding models

Related Issue

See also: #8427, #4375, #6491, #3569

Type of Change

• ✨ New feature (non-breaking change that adds functionality)
• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

New files:

• hermes_cli/vertex_adapter.py — credential resolution (SA JSON or ADC), token caching with 5-min refresh window, base URL construction. Falls back from ADC to SA file if ADC refresh fails.

Provider registration:

• hermes_cli/auth.py — register vertex in PROVIDER_REGISTRY with VERTEX_CREDENTIALS_PATH / GOOGLE_APPLICATION_CREDENTIALS env var priority
• hermes_cli/providers.py — register vertex in HERMES_OVERLAYS (openai_chat transport); add aliases vertex-ai, google-vertex
• hermes_cli/models.py — add vertex to _PROVIDER_MODELS and CANONICAL_PROVIDERS; fix validate_requested_model to strip google/ prefix for catalog lookup
• hermes_cli/model_normalize.py — inject mandatory google/ publisher prefix for Vertex requests transparently
• hermes_cli/setup.py — add vertex to setup model picker catalog

Runtime:

• hermes_cli/runtime_provider.py — replace 30-line inline credential block with a 5-line get_vertex_config() call; supports both SA file and ADC; token cached and auto-refreshed
• hermes_cli/main.py — dedicated _model_flow_vertex() flow: shows credential status without prompting, prompts for region only, suppresses spurious normalization warning for the mandatory google/ prefix
• run_agent.py — exclude vertex from the generic "API key not found" fail-fast check (vertex uses file-based credentials, not a key env var)

Dependencies:

• pyproject.toml — lightweight [vertex] optional dependency group (google-auth)

How to Test

1. Install the optional dependency: pip install hermes-agent[vertex]
2. Set GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json (or run gcloud auth application-default login)
3. Run hermes model, select Vertex AI — should show credential path with ✓, prompt for region only, then show model picker
4. Select a model (e.g. gemini-2.5-pro) and start a session — no "model not found in catalog" warning should appear

Checklist

Code

• My commit messages follow Conventional Commits
• I searched for existing PRs — this addresses correctness issues in feat(vertex): add Vertex AI provider for Gemini models (service account + ADC) #8427 which covers the same feature
• My PR contains only changes related to this feature
• I've tested on macOS 15

Documentation & Housekeeping

• N/A — no new config keys beyond what's described above
• Cross-platform impact considered (credential path handling uses os.path.exists, works on Windows/macOS/Linux)

Screenshots / Logs

$ hermes model
  Current model:    gemini-2.5-pro
  Active provider:  Vertex AI

  Credentials: ...service-account-key.json ✓

  Region [us-central1]:
Select default model:
-> gemini-2.5-pro  ← currently in use
   gemini-2.5-flash
   gemini-2.5-flash-lite
   gemini-2.0-flash-001
   gemini-2.0-flash-lite-001
   Enter custom model name
   Skip (keep current)

  Default model set to: gemini-2.5-pro (via Google Vertex AI, us-central1)

[teknium1]

Superseded by #56363, which adds Google Vertex AI as a first-class Gemini provider on current main (OAuth2 via service-account JSON / ADC on the OpenAI-compatible endpoint, per-turn token refresh, setup/model/desktop pickers, docs + tests).

That PR salvaged the earliest submission in this cluster (#8427 by @slawt) and preserved its authorship. Closing this as a duplicate — thanks for working on the same gap; the merged implementation covers the Gemini-via-Vertex use case. If you spot something it misses, please open a focused follow-up.