feat: show Codex credential label in CLI status bar

[xianyu997]

Summary

• Show the active OpenAI Codex credential label in the CLI status bar when using the openai-codex provider
• Prefer the runtime provider source label and fall back to the credential pool label
• Truncate long labels to keep the status bar compact

Test Plan

• ./venv/bin/python -m pytest tests/cli/test_cli_status_bar.py -q -o 'addopts='

[teknium1]

Thanks for the contribution — the feature still looks relevant because current main’s CLI status snapshot/rendering has no Codex credential label path (cli.py:3836, cli.py:4161).

Problems

• The fallback label lookup runs on the status-bar render path and calls load_pool("openai-codex").select() (cli.py:3105-3108 at PR head 6d00af83). On current main, CredentialPool.select() goes through _select_unlocked() (agent/credential_pool.py:1223), which can refresh credentials and mutate/persist pool state, including least-used request_count increments (agent/credential_pool.py:1354-1360) and round-robin priority rotation (agent/credential_pool.py:1362-1368). Status rendering should be read-only.
• The tests cover _provider_source = "pool:...", but current main’s explicit openai-codex runtime returns source: "explicit" (hermes_cli/runtime_provider.py:1150-1156), so the common explicit-provider path depends on that side-effecting fallback.

Suggested changes

• Prefer already-resolved runtime state, or use a read-only pool lookup such as CredentialPool.peek() (agent/credential_pool.py:1375-1380) / self._credential_pool set during runtime credential resolution (hermes_cli/cli_agent_setup_mixin.py:125).
• Add a test for the explicit openai-codex path where _provider_source is "explicit" and the displayed label comes from the active pool entry without selecting/rotating credentials.

Automated hermes-sweeper review.

[teknium1]

Thanks for the focused status-bar contribution. The requested label is still absent from current main (cli.py:4549-4591, cli.py:5063-5249), but the fallback needs to remain read-only.

Problems

• PR cli.py:3107 calls CredentialPool.select() during status rendering. On current main, selection can refresh pool entries (agent/credential_pool.py:1527-1528), increment least-used counters (agent/credential_pool.py:1539-1545), or persist round-robin rotation (agent/credential_pool.py:1547-1554). A repaint must not alter credential routing or persisted pool state.
• The tests cover only pool: sources. Explicit Codex resolution reports source: "explicit" (hermes_cli/runtime_provider.py:1400-1418), so the side-effecting fallback remains untested.

Suggested changes

• Carry the active label in resolved runtime state and have the snapshot read it; do not select from the pool in the renderer. CredentialPool.peek() is the read-only alternative (agent/credential_pool.py:1560-1565).
• Add an explicit-provider test that proves rendering does not invoke selection.

Automated hermes-sweeper review.

[teknium1]

select() is not a read-only lookup: current main refreshes entries, increments least-used counters, and persists round-robin rotation (agent/credential_pool.py:1527-1554). Calling it from the repeatedly-rendered status snapshot can change the active credential; retain the resolved label or use a read-only lookup instead.