feat(registry): add canonical user registry for cross-platform identity resolution

[Phoenix1819]

Summary

This PR introduces a lightweight, YAML-backed user registry that enables canonical user identity resolution across all messaging platforms.

Problem

Hermes agents currently identify users by platform-specific IDs (Telegram user_id, Matrix MXID, Signal phone number). This makes it impossible to:

• Recognize the same person across platforms
• Implement per-user memory isolation
• Build guardian/dependent access controls
• Scope features by user type (eg. adult vs child)

Solution

A standalone user_registry.py module that loads ~/.hermes/users.yaml and provides bidirectional lookups.

API

• resolve_canonical_name(user_id, platform) → canonical name
• resolve_user_id(name, platform) → platform-specific ID
• resolve_for_store(user_id, platform) → DB-safe canonical name
• get_guardians(child) / get_dependents(guardian) → relationship graph
• get_visible_names(user_id, platform) → scoped context visibility
• get_user_scope(name) / get_user_scope_by_id(id) → 'adult' | 'child'
• reload_registry() → hot-reload from disk

Design Decisions

• Lazy loading: registry is parsed once and cached; no startup penalty
• Zero core integration: this PR adds only the utility module
• Follow-up PRs will wire it into:
  • Gateway auth / pairing (gateway/platforms/base.py)
  • Holographic memory store isolation (hermes_state.py)
  • Per-user kanban and cron routing

Backwards Compatibility

• File is optional — if ~/.hermes/users.yaml does not exist, all lookups return None or default gracefully
• No existing code paths are modified

Testing

• Manual verification with sample users.yaml
• Unit tests will be added in the integration follow-up PR

[Phoenix1819]

CI Failure Breakdown (post-fix a57af9a0f):

Fixed (PR-specific):

• ruff PLW1514: Added encoding="utf-8" to open() in user_registry.py
• check-attribution: Correct attribution email is phoenix@sent.as — the commit was authored from phoenix@Phoenix-Mac.local locally. Mapping added to AUTHOR_MAP as a stopgap; happy to amend commit author if preferred.

Pre-existing / Unrelated failures:

• test — 7 failures in unrelated files (tts_media_routing, async_httpx, process_registry, etc.)
• e2e — 9 failures in session-reset tests from PR Support passing morph snapshot id #2, not this branch
• Windows footguns — process_registry.py failures (not our file)
• uv lock --check — lockfile outdated (no dep changes in this PR)
• Supply chain audit — false positive on pre-existing setup.py

The two PR-specific issues are now resolved. The remaining 5 check failures exist on upstream/main and are unrelated to user_registry.py.

[Phoenix1819]

Fork CI Results (independent validation on pr22085-dispatch)

View run details

Summary: 21654 passed, 9 failed, 57 skipped (~12 min)

All 9 failures are pre-existing baseline issues unrelated to this PR:

• gateway/test_restart_drain.py — string mismatch on draining status
• gateway/test_tts_media_routing.py (3) — mock await failure on post-stream media extraction
• hermes_cli/test_update_gateway_restart.py (3) — PID filtering returns empty on Ubuntu runner
• run_agent/test_async_httpx_del_neuter.py — stale loop entry cache issue
• tools/test_vision_native_fast_path.py — no vision provider configured in CI

Zero regressions introduced by this branch.