fix(gateway): add canonical cache paths to MEDIA_DELIVERY_SAFE_ROOTS

[liuhao1024]

What does this PR do?

MEDIA_DELIVERY_SAFE_ROOTS missed the canonical ~/.hermes/cache/ paths when get_hermes_dir() resolved to a legacy location. This caused valid Hermes-managed media artifacts to be silently filtered out before gateway delivery.

Related Issue

Fixes #33549

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• See commit messages for detailed changes

How to Test

1. Run pytest tests/ -q — all tests should pass
2. Verify the specific scenario described above is resolved

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 26.4.1

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture and workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A

Code Intelligence

• Analyzed: MEDIA_DELIVERY_SAFE_ROOTS (gateway/platforms/base.py, line 830) — used by _media_delivery_allowed_roots() → validate_media_delivery_path() → filter_media_delivery_paths()
• Blast radius: LOW — adds safe paths, does not remove or change existing behavior
• Related patterns: get_hermes_dir() backward compatibility (hermes_constants.py:197) — new installs use canonical paths, existing installs keep legacy paths

Tests

• Added TestMediaDeliverySafeRootsDefaults in test_platform_base.py verifying both canonical and legacy paths are present
• All 11 existing TestMediaDeliveryPathValidation tests pass
• 2 files changed, +42 lines

Checklist

• One root cause per PR
• Regression tests added
• git diff --stat upstream/main shows only relevant files (2 files)
• No unrelated changes

[alt-glitch]

Competing fix for #31733/#33549 — same change as open #31764, #33238, #33251, and #33550 (all add canonical cache paths to MEDIA_DELIVERY_SAFE_ROOTS). Recommend consolidating into a single PR.

[teknium1]

Thanks for this — the fix is correct, but it's already on main. The top-level ~/.hermes/cache/images (and sibling cache/*) roots were added to MEDIA_DELIVERY_SAFE_ROOTS in #34485, so the original symptom in #31733 is resolved.

The issue was then reopened for a narrower case your PR doesn't cover: profile-scoped gateways with a symlinked HERMES_HOME (e.g. /opt/data → /root/.hermes with $HOME not under /root), where the model emits profiles/<name>/cache/images/... paths. That's being fixed in #54060 (per-profile cache roots added to the allowlist).

Closing as already-implemented. Appreciate the contribution.