fix(agent): preserve real HOME for session tools

[sweetcornna]

Fixes #36144.

Summary

• keep host tool subprocesses on the user's real HOME so git, ssh, gh, npm, az, and similar CLIs can find existing credentials/config
• repair HOME back to the OS account home when the parent process already points at a Hermes profile home, with HERMES_REAL_HOME as an explicit override
• add Windows fallback repair through USERPROFILE and HOMEDRIVE/HOMEPATH when Unix pwd is unavailable
• preserve Docker/Podman behavior by continuing to use {HERMES_HOME}/home inside containers for persistent tool state
• update local env, code execution, ACP child env, profile docs, CLI tips, and regression coverage
• isolate strict API validation tests from live provider metadata lookups so CI does not depend on api.fireworks.ai

Verification

• .venv\\Scripts\\python.exe -m pytest tests/test_subprocess_home_isolation.py::TestGetSubprocessHome::test_profile_home_env_is_corrected_to_userprofile_when_pwd_unavailable -q --timeout-method=thread -> 1 passed after failing before the fix
• .venv\\Scripts\\python.exe -m pytest tests/test_subprocess_home_isolation.py::TestGetSubprocessHome tests/test_subprocess_home_isolation.py::TestSanitizeSubprocessEnvHomeInjection tests/test_subprocess_home_isolation.py::TestPythonProcessUnchanged -q --timeout-method=thread -> 14 passed
• .venv\\Scripts\\python.exe -m pytest tests/test_subprocess_home_isolation.py tests/agent/test_copilot_acp_client.py tests/tools/test_env_passthrough.py tests/tools/test_code_execution.py tests/tools/test_code_execution_modes.py tests/cron/test_cron_profile.py -q --timeout-method=thread -> 124 passed, 43 skipped
• .venv\\Scripts\\python.exe -m pytest tests/run_agent/test_strict_api_validation.py -q --timeout-method=thread -> 4 passed
• .venv\\Scripts\\python.exe -m ruff check hermes_constants.py hermes_cli/profiles.py hermes_cli/tips.py tools/environments/local.py tools/code_execution_tool.py agent/copilot_acp_client.py cron/scheduler.py tests/test_subprocess_home_isolation.py tests/agent/test_copilot_acp_client.py tests/cron/test_cron_profile.py tests/test_hermes_constants.py tests/run_agent/test_strict_api_validation.py -> passed
• .venv\\Scripts\\python.exe -m py_compile hermes_constants.py hermes_cli/profiles.py hermes_cli/tips.py tools/environments/local.py tools/code_execution_tool.py agent/copilot_acp_client.py cron/scheduler.py tests/test_subprocess_home_isolation.py -> passed
• git diff --check -> passed

Note: the broader local Windows run that also included tests/tools/test_local_env_blocklist.py and all of tests/test_hermes_constants.py still has three environment/platform-specific failures unrelated to this diff: Homebrew PATH assertion on Windows, Windows native default Hermes root expectation, and symlink creation without Windows developer/admin privileges.

[teknium1]

Thanks for the thorough HOME-policy fix. This is already implemented on current main; this is an automated hermes-sweeper review.

• Commit 723c2331bd236fdb9bbc0d6e6f85a1b7704e4aa1 (fix: make profile subprocess HOME policy explicit) implements the host-default real HOME policy, container {HERMES_HOME}/home behavior, repair of profile-bound parent HOME, and explicit real-home handling.
• hermes_constants.py:748-791 defines the auto / real / profile policy and propagates HERMES_REAL_HOME.
• The shared policy is applied to local/background terminal processes (tools/environments/local.py:413, :528, :860), execute_code (tools/code_execution_tool.py:1332), and Copilot ACP (agent/copilot_acp_client.py:109).
• Equivalent regression coverage is present in tests/test_subprocess_home_isolation.py:51-111, :181-214, :270-301, and tests/agent/test_copilot_acp_client.py:282-299.
• The superseding commit is included in v2026.6.19.