test: keep tirith checks hermetic

[teknium1]

Summary

Salvages the hermeticity-only half of #30643 — five tests no longer depend on host state (cosign installed, PID 42 alive, host WSL kernel, host auxiliary credentials, Tirith auto-install). Drops the min(4, cpu_count) worker cap from that PR; we want more parallelism, not less.

Changes

• tests/conftest.py: set TIRITH_ENABLED=false in the hermetic fixture so unit tests never trigger Tirith's GitHub auto-install
• tests/tools/test_tirith_security.py: patch shutil.which for the cosign-missing branch so the assertion holds regardless of whether the host has cosign
• tests/gateway/test_runner_startup_failures.py: stub _pid_exists so the replace/force startup test doesn't depend on PID 42 being alive on the host
• tests/agent/test_context_compressor.py: explicitly simulate no-summarizer via call_llm side_effect (was discovering real auxiliary credentials from auth state)
• tests/tools/test_voice_mode.py: shim /proc/version for the non-WSL paths so the tests work on WSL hosts too

Validation

scripts/run_tests.sh tests/agent/test_context_compressor.py tests/gateway/test_runner_startup_failures.py tests/tools/test_voice_mode.py tests/tools/test_tirith_security.py → 244/244 passed.

Credit: @helix4u (original PR #30643).

Infographic

[github-actions]

🔎 Lint report: hermes/hermes-7abd2aa1 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 8998 on HEAD, 8998 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 4776 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.