fix(gateway): restore credential pools for session overrides

[Qwinty]

What does this PR do?

Restores the missing helper used by the gateway session model override fast path. Complete persisted /model overrides include an API key and should avoid global runtime resolution, but current main calls _load_credential_pool_for_provider(...) without defining it. That raises NameError before an agent is created and messaging users see a generic provider authentication failure with api_calls=0.

The helper is intentionally best-effort: it returns a credential pool when available, and otherwise falls back to None so a complete session override with an explicit API key still works.

Related Issue

No existing issue found. I searched related PRs/issues for _load_credential_pool_for_provider and session model override credential pool failures before opening this PR.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• gateway/run.py: adds _load_credential_pool_for_provider() for persisted session runtime overrides, with safe fallback when the pool cannot be loaded.

How to Test

1. Reproduce on current main by running the focused gateway test:
   python -m pytest -q -o addopts='' tests/gateway/test_session_model_override_routing.py::test_run_agent_prefers_session_override_over_global_runtime
2. It fails before this fix with Provider authentication failed: name '_load_credential_pool_for_provider' is not defined.
3. Verify after this fix:
   /usr/local/lib/hermes-agent/venv/bin/python -m pytest -q -o addopts='' tests/gateway/test_session_model_override_routing.py tests/gateway/test_model_switch_persistence.py
/usr/local/lib/hermes-agent/venv/bin/python -m ruff check gateway/run.py tests/gateway/test_session_model_override_routing.py tests/gateway/test_model_switch_persistence.py

Result: 12 passed, 1 warning; ruff passed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Ubuntu 24.04

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Relevant pre-fix failure from focused test:

Provider authentication failed: name '_load_credential_pool_for_provider' is not defined

Full test commands and results are listed above.

[Qwinty]

Scope note: this draft remains focused on restoring credential pools for persisted session runtime overrides. The separate live Codex quota/exhaustion bug is now isolated in draft PR #31032.\n\nThat separation matters because this PR only reloads the pool object for an override; it does not change Codex usage-limit reconciliation or duplicate quota grouping. If #31032 lands first, this PR is still the small gateway/session-override follow-up.

[Qwinty]

Decision after updating #31032: leaving this PR as a draft fallback for now, not marking it ready.

#31032 now includes this exact helper as commit 08f382cd0 and is mergeable on current main, so if #31032 lands this draft should be closed as superseded. Keeping the draft open until #31032 CI/maintainer outcome is clear preserves the small 15-line gateway-only fix as a fallback path without asking maintainers to review two overlapping ready PRs.

[Qwinty]

Closing as superseded by #31032. The updated #31032 branch now includes the session override credential-pool helper plus the broader Codex credential-pool recovery fixes, and its test matrix is green apart from the still-running Docker arm64 build.