fix(oneshot): honor --resume/--continue so -z can be session-aware

[jibot3]

Problem

hermes -z (oneshot) bypasses cli.py entirely and historically ignored --resume / --continue. It always built a fresh AIAgent and called agent.chat(), so the flags were silently dropped.

This bites any frontend that drives oneshot with a stable session id per conversation — e.g. a small HTTP shim that runs hermes --profile p -z "<prompt>" --continue <id> for each inbound message (a piped-channel bridge). The agent is amnesiac: every turn starts with history=0 and writes a new throwaway timestamped session, so the requested id never accumulates a transcript. The user sees "this is the first thing you've said to me" on every message.

Reproduce:

SID="diag-$(date +%s)"
hermes -z "Remember codeword PURPLE-NARWHAL-42. Ack." --continue "$SID"
hermes -z "What codeword did I give you?" --continue "$SID"
# turn 2 (before fix): "this is the first message."

Fix

Make oneshot session-aware when (and only when) a session is requested:

• hermes_cli/main.py -z dispatch resolves --resume/-r <id|title> or --continue/-c [name] (reusing the existing _resolve_session_by_name_or_id / _resolve_last_session) and passes session_id to run_oneshot.
• hermes_cli/oneshot.py run_oneshot threads session_id to _run_agent.
• _run_agent, when session_id is set: walks the compression chain to the live tip (resolve_resume_session_id), loads prior history (get_messages_as_conversation), reopens the session, builds AIAgent(session_id=...), and runs via run_conversation(conversation_history=...) so the transcript replays and only new messages flush back under the same id. With no session_id the path is unchanged — a fresh, stateless one-shot run.

create_session is INSERT OR IGNORE, so reusing an id is idempotent and a brand-new conversation id works on its first turn (empty history, created on first write).

Why not switch the caller to chat -q --resume?

That path is session-aware but emits banner/box/"Resume this session with…" chrome on stdout, which a piping caller then has to strip with fragile rules. Fixing oneshot keeps -z's clean single-block stdout contract intact.

Tests

Added to tests/hermes_cli/test_tui_resume_flow.py:

• main -z dispatch forwards the resolved session id to run_oneshot;
• _run_agent(session_id=...) resumes with replayed history via run_conversation (not chat) and reopens the session;
• the no-session path stays on chat() with session_id=None (stateless behavior unchanged).

Also updated the existing test_main_top_level_oneshot_accepts_toolsets exact-match assertion for the new session_id kwarg. Full file: 48 passed.

After: turn 2 above correctly answers PURPLE-NARWHAL-42, and a single session id holds the whole conversation.