fix(telegram): enforce 32-char limit on command names with collision avoidance

[teknium1]

Summary

Telegram Bot API requires command names to be 1-32 characters. Plugin and skill names that exceed this limit cause setMyCommands to fail silently. This adds collision-safe truncation to telegram_menu_commands().

How it works

New _clamp_telegram_names() helper enforces the limit:

1. Names ≤ 32 chars pass through unchanged
2. Names > 32 chars are truncated to 32
3. If truncation creates a collision (with core commands, other plugins, or other skills), the name is shortened to 31 chars and a digit 0-9 is appended
4. If all 10 digit slots are taken, the entry is silently dropped

Core CommandDef names are tracked as reserved so truncated names never shadow them. Plugin names are clamped before skills, so plugins get priority in collision resolution.

Changes

• hermes_cli/commands.py: Added _clamp_telegram_names() helper, wired into both plugin and skill collection paths in telegram_menu_commands()
• tests/hermes_cli/test_commands.py: 9 new tests — truncation, digit suffixes, reserved collision, digit exhaustion, dedup, integration

Addresses the fix from PR #4191 (sroecker) with improved collision handling.

Testing

• All 74 command tests pass (including 9 new)
• All 1778 gateway tests pass
• No current skill exceeds 32 chars (longest is 27), but the fix is defensive for future skills and plugin commands

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py
tests/hermes_cli/test_setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.