fix(honcho): use _host_block helper for dot-form legacy host key fallback (fixes #37436)

[Morad37]

What does this PR do?

Fixes a silent auth failure in the Honcho runtime client path. _resolve_or_create_client() reimplemented the host-block lookup as a plain dict.get(config.host) instead of calling the existing _host_block() helper that handles the legacy dot-form-to-underscore-form fallback. When config.host is hermes_profile_a (underscore — the format returned by profile_host_key()) but the JSON config stores it as hermes.profile_a (dot — the old format the helper is designed to bridge), the direct lookup misses and effective_api_key is set to "local" — every Honcho API call returns 401, silently dropping cross-peer queries and message sync.

Changes

• plugins/memory/honcho/client.py: 2-line change — replace the bare (_raw.get("hosts") or {}).get(config.host, {}) with _host_block(_raw, config.host). Renamed the local from _host_block to _host_block_local to avoid shadowing the function.

How to test

1. ~/.hermes/hermes-agent/venv/bin/python -m pytest tests/honcho_plugin/ -q --timeout=120 — 316/316 pass, 17 skipped (unchanged).

Notes

• The repro case: a ~/.hermes/honcho.json with host keys in dot form ("hermes.profile_a") and baseUrl: "http://localhost:8000" (the _is_local branch). Before the fix, _host_has_key is False and effective_api_key = "local" → 401 Invalid JWT on every write/read.
• After the fix, _host_block() tries dot-form first, then falls back to underscore-form, so both formats work.
• This bug was the third most operationally damaging entry in bug(honcho): self-hosted localhost setup silently fails — apiKey trap, no recursive fallback, 30s timeout, silent error masking #36098's Honcho plugin trap-path catalogue.

Closes #37436

[teknium1]

Thanks for isolating the inconsistent local-auth lookup. The production change matches the existing resolver behavior: current main's _host_block() supports the dot-form fallback at plugins/memory/honcho/client.py:44-51, while the local branch bypasses it at plugins/memory/honcho/client.py:884-887.

Problems

• This PR has no regression test. The existing dot-form test at tests/honcho_plugin/test_client.py:530-544 verifies config loading only; it does not assert that a localhost get_honcho_client() call passes the legacy host's configured key to the SDK.
• The equivalent OAuth refresh reads still use direct host lookups at plugins/memory/honcho/oauth.py:279 and :292. get_honcho_client() invokes that refresh at plugins/memory/honcho/client.py:754 and :771, so legacy dot-form OAuth grants remain unable to refresh.

Suggested changes

• Add the localhost legacy-host API-key construction regression test.
• Apply the same legacy-key resolution to OAuth reads and preserve the resolved legacy block when persisting a rotated credential.

Automated hermes-sweeper review.

[teknium1]

Please add a regression test that constructs a localhost client from hosts.hermes.profile_a with active host hermes_profile_a and asserts the SDK receives the configured API key. The current dot-form test covers only from_global_config, not this loopback auth branch.