fix(auth): re-resolve Kimi pool base URLs

[LeonSGP43]

Summary

• normalize loaded kimi-coding credential-pool entries with the current API key prefix rules
• keep explicit KIMI_BASE_URL overrides authoritative
• add regression coverage for stale Moonshot base_url values on sk-kimi keys

Fixes #5908

Verification

• scripts/run_tests.sh tests/hermes_cli/test_api_key_providers.py::TestKimiCodeCredentialPoolAutoDetect tests/hermes_cli/test_api_key_providers.py::TestKimiCodeCredentialAutoDetect
• scripts/run_tests.sh tests/hermes_cli/test_api_key_providers.py
• git diff --check origin/main...HEAD

[teknium1]

Thanks for targeting the persisted Kimi pool case. The stale-entry premise remains valid on current main: hermes_cli/auth.py:1340-1345 returns stored entries unchanged, agent/credential_pool.py:2342-2355 rehydrates them, and hermes_cli/runtime_provider.py:409 uses the selected entry’s URL.

Problems

• hermes_cli/auth.py:962 overwrites every Kimi entry’s stored base_url. Current runtime deliberately treats a non-default pool URL as explicit (hermes_cli/runtime_provider.py:476-485), so this would replace intentionally configured proxy/custom endpoints.
• The current read_credential_pool() has profile/global per-provider fallback semantics at hermes_cli/auth.py:1301-1345; the proposed hunk predates that implementation and must be integrated with it.

Suggested changes

• Normalize only missing or known-stale default URLs, while preserving non-default stored URLs absent an explicit KIMI_BASE_URL override.
• Add a pool-to-runtime regression test, plus preservation coverage for a non-default pool URL.

Automated hermes-sweeper review.

[teknium1]

This rewrites every persisted Kimi endpoint, including a deliberate non-default proxy/custom URL. Current runtime treats non-default pool URLs as explicit (hermes_cli/runtime_provider.py:476-485); please limit rewriting to missing or known-stale default URLs, while retaining explicit endpoint values unless KIMI_BASE_URL is set.

[DavidMetcalfe]

@LeonSGP43 — thanks for starting the initial work on this! Following up on the sweeper's keep_open review, the requested changes were: (1) preserving custom/non-default stored URLs, (2) integrating with the current profile/global fallback semantics in read_credential_pool, and (3) adding pool-to-runtime plus custom-URL preservation regression tests.

Since this PR hasn't seen updates since May (and the test check has been failing), I implemented those changes in #83537 (addressing #5908) so the fix doesn't stall. If you'd like to continue with this PR instead, the review feedback is still actionable and the tests from #83537 can be cherry-picked over — otherwise we can proceed with #83537.