fix(agent): ignore stale local base_url for direct providers

[Tranquil-Flow]

Summary

• Ignore stale loopback model.base_url values when a direct API-key provider from PROVIDER_REGISTRY is selected.
• Clear the stale local override before client construction so resolve_provider_client() uses the provider's canonical endpoint.
• Add a regression test for migrating to deepseek with an old http://localhost:8081/v1 base URL.

Fixes #30033

Test plan

• python -m pytest tests/run_agent/test_run_agent.py::test_direct_provider_ignores_stale_local_base_url -q -o addopts=
• python -m pytest tests/run_agent/test_run_agent.py -q -o addopts=
• python -m py_compile agent/agent_init.py tests/run_agent/test_run_agent.py

Notes

This is intentionally narrow: it only handles loopback URLs (localhost, 127.0.0.1, ::1) for direct registry providers, and leaves custom/aggregator routing behavior unchanged.

[talwayh1]

CI Fix: test_auth_remove_copilot_suppresses_all_variants

Root Cause: load_pool() prunes the gh_cli borrowed credential entry because resolve_copilot_token() returns empty in CI/test environment (pitfall #13 — borrowed-source entries silently removed by _prune_stale_seeded_entries).

Fix: Monkeypatch copilot token resolution before auth_remove_command call so the gh_cli entry survives pruning.

monkeypatch.setattr(
    "hermes_cli.copilot_auth.resolve_copilot_token",
    lambda: ("ghp_fake", "gh auth token"),
)
monkeypatch.setattr(
    "hermes_cli.copilot_auth.get_copilot_api_token",
    lambda token: token,
)

Fix available at talwayh1/hermes-agent:ci-fix/test-auth-remove-copilot-monkeypatch:

git fetch https://github.com/talwayh1/hermes-agent.git ci-fix/test-auth-remove-copilot-monkeypatch
git cherry-pick 9e4801376

[teknium1]

Thanks for isolating the migration scenario. The current-main issue is still present, but this implementation needs to move to the runtime resolver.

Problems

• agent/agent_init.py:981-987 re-invokes resolve_provider_client() after clearing only local variables. The resolver then rereads matching model.base_url and prefers it at hermes_cli/runtime_provider.py:2028-2032, so the stale configured loopback URL returns.
• The proposed registry-and-loopback predicate also includes LM Studio: hermes_cli/auth.py:212-219 declares its canonical 127.0.0.1 endpoint, and tests/hermes_cli/test_runtime_provider_resolution.py:415-453 requires saved LM Studio URLs to be preserved.
• The new test mocks resolve_provider_client, so it does not execute the config-resolution behavior above.

Suggested changes

• Put the stale-route guard at hermes_cli/runtime_provider.py:2028-2032, with an explicit local-provider exclusion/capability, and add a resolver-level DeepSeek regression that uses the persisted config.

Automated hermes-sweeper review.

[teknium1]

Clearing the init-local value here does not prevent the later resolve_provider_client() call from rereading the same matching model.base_url (hermes_cli/runtime_provider.py:2028-2032). Please enforce the stale-route rule in the runtime resolver instead, and exclude local-serving registry providers such as LM Studio.