feat: add Infisical secret source

[feliche93]

Summary

• Add native Infisical Universal Auth secret loading so Hermes can populate process environment variables before gateway/platform config is built.

Changes

• Features
  • Add agent.secret_sources.infisical with Universal Auth login, v4 secret listing, self-hosted api_url, imports, recursive fetch, secret-reference expansion, and in-process caching.
  • Add hermes secrets infisical setup/status/sync/disable CLI commands, including the inf alias.
  • Wire Infisical into dotenv startup loading alongside Bitwarden without making Bitwarden a prerequisite.
• Docs
  • Document Infisical setup, config options, self-hosted usage, and runtime behavior.
  • Add example .env and config entries for Infisical bootstrap credentials.
• Tests
  • Add coverage for Infisical request shape, cache behavior, env override semantics, bootstrap protection, malformed config, and env-loader source tracking.

Commits

• 5b572cc feat: add Infisical secret source

Related Issues

• [Feature]: Add Infisical as an External Vault backend (sub-issue of #3630) #22791

[teknium1]

Thanks for the substantial Universal Auth implementation and the self-hosted use-case coverage reflected in #22791.

Automated hermes-sweeper review found this PR falls under the standing third-party integration policy:

• Current docs explicitly place Infisical in standalone SecretSource plugin repositories: website/docs/user-guide/secrets/index.md:30-34.
• The supported extension point is available: implement agent.secret_sources.base.SecretSource and register it with ctx.register_secret_source(...); the orchestrator owns timeout, precedence, protected bootstrap variables, conflict handling, and provenance (website/docs/developer-guide/secret-source-plugin.md:15-158).
• The current registry deliberately closes the bundled set to Bitwarden and 1Password (agent/secret_sources/registry.py:19-25).

Please publish the Infisical backend as a standalone plugin repository and share it in #plugins-skills-and-skins. That preserves the useful Universal Auth work while avoiding vendor-specific core maintenance.

---

Closed by automated hermes-sweeper review as not planned under in-tree-provider-integration. This is a coupling and maintenance policy decision, not a judgment on the quality of the contribution.

---

Closed as not-planned per standing maintainer policy (in-tree-provider-integration). This is a design-direction decision, not a code-quality judgment — see the Contribution Rubric in AGENTS.md for what the project is looking for. If you believe this policy was misapplied to your change, comment here and a maintainer will take a look.