feat(agent): add ClaudeLocalClient subprocess shim for Claude Max OAuth accounts

[benmont]

Summary

Implements the subprocess-based adapter approach discussed in #15080 as a long-term solution for Claude Max OAuth accounts that cannot use the direct HTTPS path with tools.

• Adds `agent/claude_local_client.py`: a `ClaudeLocalClient` class that shells out to the official `claude` CLI binary to handle inference requests, translating between Hermes's internal message format and the CLI's stdin/stdout protocol
• Keeps the existing direct HTTPS path as the default; `ClaudeLocalClient` is opt-in when the `claude` binary is available and the account has no overage credits
• Tool calls, tool results, and conversation history round-trip correctly through the subprocess boundary
• The CLI handles OAuth token refresh and tool-use authorization natively, bypassing the third-party classifier that rejects direct API requests

Closes #15080 (long-term solution path).

Test plan

• `claude` CLI binary present and authenticated with a Claude Max OAuth account
• Confirm tool-carrying requests succeed end-to-end through the shim
• Confirm fallback to direct HTTPS path when `claude` binary is absent

🤖 Generated with Claude Code

[alt-glitch]

Related: #6427 (Claude CLI subprocess transport, open P3), #26634 (cli-shim RFC for claude/codex/gemini CLIs via OAuth, open P3), #12229 (claude-code-acp provider). These cover overlapping approaches to the same problem — running Hermes inference through CLI binaries for subscription accounts.

[benmont]

Thanks for the pointers — I wasn't aware of these. Looking at them, the overlap is real: #6427 takes the same subprocess approach as this PR but is more properly integrated into the Hermes provider system, and #12229 is a considerably more complete solution at P2. This PR doesn't add enough differentiation to justify a separate implementation.

I'll close this one. Happy to help test or contribute to #6427 or #12229 if useful — I have a Claude Max account that reliably reproduces the #15080 failure, which could be handy for integration testing.