feat(agent): finite first-chunk timeout + failover for local OpenAI-compatible streams

[OmarB97]

What

Local OpenAI-compatible backends currently get an unbounded wait in two failure modes: a stream that is accepted but never emits its first SSE chunk, and a non-streaming call whose server sends no response headers until the entire completion finishes. Both wedge the turn instead of failing over.

How

• HERMES_LOCAL_FIRST_CHUNK_TIMEOUT (default 90s, scales with estimated request context) bounds time-to-first-chunk for local streams; on expiry the connection is killed, the error is marked, and FailoverReason.local_first_chunk_timeout routes straight to the fallback chain instead of rebuilding the same wedged client.
• HERMES_LOCAL_NON_STREAM_STALE_TIMEOUT (default 120s, context-scaled) makes local non-streaming calls finite.
• Streaming stale timeouts for local endpoints keep the historical unbounded default; HERMES_LOCAL_STALE_TIMEOUT is an opt-in bound for backends known to park requests on open sockets.

Tests

tests/agent/test_local_stream_timeout.py (boundaries, opt-in, env precedence), tests/agent/test_error_classifier.py (marker classification), tests/hermes_cli/test_timeouts.py (finite local non-stream default), plus an ordering assertion that first-chunk fallback precedes primary-transport recovery. 230+ tests pass locally.

This is part 4 of the former #35642 split; rewritten per review feedback to be model-name agnostic (no model-specific env vars or heuristics) and to drop the unrelated oneshot logging changes.

[OmarB97]

Refreshed onto current upstream/main via rebase (real merge-base — an earlier "no common ancestor" read on a sibling PR in this wave turned out to be a shallow-clone artifact, not true history divergence). Two commits replayed (an earlier orphan refresh + a follow-up bug-fix that patched two regressions in it), then squashed to one. One real conflict, in agent/chat_completion_helpers.py at two spots: upstream independently grew the cross-turn stale-call circuit breaker (#58962) in the same locations since this branch's last refresh. Both features are additive — kept upstream's circuit-breaker block ahead of the local-provider timeout resolvers, and folded _check_stale_giveup(agent) into the same result-dict block that carries local_first_chunk_timeout. Everything else (5 files + the 4 test files) auto-merged clean. Ran the full touched-module suite locally: test_local_stream_timeout.py, test_error_classifier.py, test_timeouts.py, test_run_agent.py — 684 passed. Prior head: 0440c4c625; new head: 82d4649e9f. Force-pushed with lease; checks re-running.

[teknium1]

Thanks for the careful refresh, focused tests, and preservation of the existing stale-call circuit-breaker work. The local no-first-chunk problem is real, but this implementation cannot land in its current configuration form.

• Automated hermes-sweeper review found that the PR's user-facing mechanism adds several non-secret timeout variables (HERMES_LOCAL_FIRST_CHUNK_TIMEOUT, HERMES_LOCAL_NON_STREAM_STALE_TIMEOUT, and aliases) in agent/chat_completion_helpers.py.
• The standing policy in AGENTS.md:102-106 requires behavioral settings such as timeouts and thresholds to use config.yaml, not new HERMES_* environment variables.
• Existing provider timeout configuration already lives under providers.<id>.stale_timeout_seconds / per-model settings in cli-config.yaml.example:108-139; a future focused proposal should use that config.yaml mechanism rather than introduce new environment-variable surfaces.

This is an automated hermes-sweeper review.

---

Closed as not-planned per standing maintainer policy (env-var-for-config). This is a design-direction decision, not a code-quality judgment — see the Contribution Rubric in AGENTS.md for what the project is looking for. If you believe this policy was misapplied to your change, comment here and a maintainer will take a look.