refactor: sweep remaining bare expanduser() to safe_expanduser() (depends on #41870)

[rickychen-xm]

What does this PR do?

Completes the adoption of safe_expanduser() across the entire core codebase, sweeping remaining bare Path().expanduser() and PathVar.expanduser() invocations that would crash with RuntimeError("Could not determine home directory") in environments where HOME cannot be resolved.

This is the follow-up sweep PR. The helper was introduced in #41870 and adopted by agent/subdirectory_hints.py as the pilot site.

Type of Change

• 🐛 Bug fix (systemic crash prevention for HOME-unset environments)
• ♻️ Refactor (mechanical conversion, no behavior change under normal conditions)

Changes Made

36 files / +106 / −70 | 70 call sites converted across 8 areas:

Area	Files	Sites
agent/	7	11
acp_adapter/	1	4
cron/	2	3
gateway/	5	10
hermes_cli/	10	28
plugins/	6	7
tools/	6	15
cli.py	1	1

Conversion pattern (mechanical):

  Path(X).expanduser()           → safe_expanduser(X)
  X.expanduser()                 → safe_expanduser(X)
  Path(X).expanduser().resolve() → safe_expanduser(X).resolve()
  Path(X).expanduser().parts     → safe_expanduser(X).parts
  Path(X).expanduser() / "foo"   → safe_expanduser(X) / "foo"

Only the expanduser() call is wrapped — all chained operations (.resolve(), .parts, /, .is_absolute() etc.) are preserved unchanged.

Not changed (out of scope)

• tests/ — test code intentionally uses bare expanduser() (valid HOME assumed)
• skills/, optional-skills/ — per-skill scripts with independent lifecycle
• utils.py — defines safe_expanduser itself

How to Test

# All core modules import cleanly
pytest tests/test_utils_expanduser.py -v

# Manual regression test — safe_expanduser recovers, Path.expanduser() still crashes
python -c "
import os, pwd
os.environ.pop('HOME', None)
pwd.getpwuid = lambda uid: (_ for _ in ()).throw(KeyError('nope'))
from utils import safe_expanduser
assert str(safe_expanduser('~/test')) == '~/test', 'should return unexpanded path'
print('PASS: safe_expanduser recovers from missing HOME')
"

Merge order

Merge #41870 first — this branch is built on top of it (both commits are included in this PR). After #41870 merges upstream, this PR's diff shrinks to just the sweep commit.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (refactor: sweep ...)
• I searched for existing PRs — no duplicate
• My PR contains only changes related to this sweep (plus the dependency commit from feat(utils): add safe_expanduser() — crash-free path expansion for HOME-unset environments #41870)
• Every modified file has been verified with python -c "import <module>" — 36/36 import clean, no syntax errors introduced
• I've added tests (in feat(utils): add safe_expanduser() — crash-free path expansion for HOME-unset environments #41870, 7 tests covering normal and failure paths)
• I've tested on my platform: macOS 26.5.1, Python 3.13

Documentation & Housekeeping

• No docs update needed — the helper's docstring covers its contract
• No config key changes
• No architecture change
• No tool descriptions changed

[teknium1]

Thanks for documenting the HOME-resolution failure mode. The failure class remains relevant, but this sweep needs a current-code audit before it is salvageable.

Problems

• The current checkout still has unhandled direct expansion in cron/lifecycle_guard.py:89; _read_script_for_scanning() catches only OSError at :108. This path is outside the PR despite matching the stated crash class. Other direct calls remain in PR-touched surfaces such as agent/context_references.py:145, tools/file_tools.py:1212, and cron/scheduler.py:2049.
• The agent/subdirectory_hints.py pilot conversion overlaps a focused implementation already on main: c126a99fc1e2f82a1e23ebe27fb52e26687fdafa catches RuntimeError at agent/subdirectory_hints.py:147, with regressions at tests/agent/test_subdirectory_hints_tilde.py:19 and :38.

Suggested changes

• Re-scope from the old static list to a fresh audit of current call sites, preserving each caller's existing error contract; include the cron lifecycle guard path or coordinate with #56517.
• Drop or re-evaluate the already-landed subdirectory-hints hunk.

Automated hermes-sweeper review.

[teknium1]

Current main already resolves this walker failure without changing expansion behavior: c126a99fc catches RuntimeError around this call, with regressions in tests/agent/test_subdirectory_hints_tilde.py:19 and :38. Re-evaluate this overlapping hunk during salvage.

[teknium1]

test_respects_default does not trigger an expansion failure, so it only proves the return type; test_default_on_expand_failure already exercises the fallback. Please either force the failure condition here or remove this redundant assertion.