[codex] Redirect terminal usage loops

[OmarB97]

Summary

• classify terminal CLI usage/parser failures by command family instead of only by raw tool arguments
• redirect repeated same-family usage errors toward help/discovery commands before executing more guessed variants
• include redirect guidance in tool results and log structured guardrail decision metadata

Root Cause

Terminal usage failures such as meshctl task view, meshctl task status --bad-flag, and similar variants all looked distinct to the existing exact-argument guardrails. The agent received only a broad same-tool failure warning, so it could keep guessing new argument forms inside the same CLI surface.

Validation

• ./scripts/run_tests.sh tests/tools/test_read_loop_detection.py tests/agent/test_tool_guardrails.py tests/run_agent/test_tool_call_guardrail_runtime.py
• python -m ruff check agent/tool_guardrails.py run_agent.py tests/agent/test_tool_guardrails.py tests/run_agent/test_tool_call_guardrail_runtime.py tests/tools/test_read_loop_detection.py
• git -c core.fsmonitor=false diff --check

[OmarB97]

Rebased and refreshed this upstream mirror at head 918401f82669baf01c19dd321fa7acb9ba1b29a0.

Current state:

• GitHub reports the PR CLEAN / MERGEABLE.
• Required checks are green: tests 1-6, e2e, typechecks, lint, Nix, Docker amd64/arm64, attribution, common ancestor, and supply-chain checks.
• Local focused verification passed before push: py_compile, git diff --check, and scripts/run_tests.sh ... with 399 passed.
• meshctl pr merge --dry-run accepted the PR with a fresh base and no stale overlap.

I attempted the actual merge through meshctl pr merge, but GitHub rejected it because OmarB97 does not have MergePullRequest permission on NousResearch/hermes-agent. This PR is ready for an upstream maintainer to merge.

[OmarB97]

Closing as a redundant intermediate of a cumulative stack. These PRs form a stack where each is a strict superset of the previous: #35632 ⊂ #35673 ⊂ #35694 ⊂ #35698 ⊂ #35702. Both ends have now been refreshed onto current upstream/main — #35632 (the clean base) and #35702 (the tip, which carries the full feature set of the entire stack). This intermediate layer is therefore a strict subset of #35702 and would create a mutually-exclusive / duplicate merge against the already-refreshed base and tip. Closing in favor of #35632 + #35702, which together deliver everything here with no redundancy.