feat: One gateway for multiple agent profiles.

[unliftedq]

What does this PR do?

Lets a single gateway process serve multiple Hermes profiles as switchable agents — instead of needing one gateway per profile bound to a separate platform credential.

User-facing surface

Input	Effect
/profile	Show the chat's active profile + host info
/profile ls	List all available profiles
/profile coder	Bind this chat to the coder profile (persisted)
/profile default	Reset to default
@coder fix bug	Route only this turn to coder; binding intact
(every reply)	Prefixed with [<agent>], toggleable via gateway.show_agent_name

Isolation guarantees

• Memory / skills / SOUL.md: hard-isolated per profile (existing ~/.hermes/profiles/<name>/ layout)
• Session / transcript: each (chat, agent) pair has its own session_id — switching back to a previously-used agent resumes its own conversation, no leakage from other agents
• Gateway runtime state (sessions DB, host platform tokens): stays in the host profile

Mechanism

• HERMES_HOME becomes a ContextVar; get_hermes_home() consults it first → per-turn agent swap with no env-var rebind
• _run_agent wraps the executor in agent_home_scope(<agent.home>) so AIAgent construction + run-conversation see the right paths
• build_session_key takes agent_name → (chat, agent) pairs get distinct session_keys → distinct transcripts; chat bindings persist to sessions/chat_bindings.json
• default agent keeps the legacy agent:main:... prefix → zero migration for existing state.db / sessions.json

Details see #24913

Related Issue

Fixes #24913

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

How to Test

1. Added comprehensive unit tests
2. Test locally.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

[teknium1]

Thanks for the substantial multi-profile gateway prototype. Current main now has an opt-in one-process multiplexer, but it deliberately uses per-profile adapters and credentials (website/docs/user-guide/multi-profile-gateways.md:59-104, :158-165), so this PR's same-token chat-routing goal remains distinct rather than redundant.

Problems

• The new agent_home_scope only redirects get_hermes_home() (gateway/run.py, PR executor-scope hunk). It does not install a profile secret scope. Current multiplexing couples the home override with set_secret_scope(build_profile_secret_scope(...)) in gateway/run.py:1413-1444; without equivalent coverage, a routed profile can resolve host-process credentials.
• gateway.show_agent_name is introduced as a user-facing setting but is not added to the normal defaults documented in hermes_cli/config.py:2843-2875.
• The branch predates current profile attribution and multiplexing seams: gateway/session.py:850-883 now owns profile session namespaces, while gateway/run.py:16825-16869 scopes a routed source's whole agent turn. This needs a design-level rework rather than a mechanical salvage.

Suggested changes

• Rebuild the same-token route against the current profile-runtime and credential-scope seams, and retain the default agent:main compatibility contract.
• Add the response-label setting through DEFAULT_CONFIG and docs if retained.

Automated hermes-sweeper review.

[teknium1]

agent_home_scope changes only path resolution. It does not scope profile credentials; current multiplexing pairs the home override with set_secret_scope(build_profile_secret_scope(...)) in gateway/run.py:1413-1444. Please make the routed-turn scope cover secrets too, otherwise a selected profile can resolve host-process credentials.