fix(cli): consolidate Bitwarden startup warning handling

[konsisumer]

What does this PR do?

Consolidates the Bitwarden startup warning fixes for #32715. If secrets.bitwarden.enabled is true but neither BWS_ACCESS_TOKEN nor project_id is configured, Hermes treats Bitwarden as not set up and stays silent. If setup is partial and a status line is actionable, Hermes still emits it once and suppresses duplicate inherited child-process prints during startup.

Related Issue

Fixes #32715

Supersedes

Supersedes #32784, #34314

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• agent/secret_sources/bitwarden.py: return a clean empty result when Bitwarden is enabled but both the access token and project id are absent, so fresh or untouched Bitwarden config does not print a warning.
• hermes_cli/env_loader.py: add an inherited process-environment marker for Bitwarden status output so child startup processes suppress duplicate status lines while still applying secrets and source tracking.
• tests/test_bitwarden_secrets.py: cover the enabled-but-unconfigured silent no-op case while preserving warnings for partial setup.
• tests/test_env_loader_secret_sources.py: cover inherited status suppression and first-process marker creation for actionable warnings.

How to Test

1. /opt/homebrew/bin/timeout -k 30 480 pytest tests/test_bitwarden_secrets.py tests/test_env_loader_secret_sources.py -q -> 53 passed.
2. Full suite command /opt/homebrew/bin/timeout -k 30 480 sh -c 'pytest tests/ -q -x --timeout=60 "$@"' sh stopped during collection before reaching this change because local fastapi is missing for tests/hermes_cli/test_dashboard_auth_401_reauth.py; one deselect rerun then stopped on the same missing dependency in tests/hermes_cli/test_dashboard_auth_cookies.py.
3. Mechanical covering subset discovered by grepping changed modules/importers completed past the Bitwarden/env-loader tests: 424 passed, with unrelated local-environment failures in tests/tools/test_transcription_dotenv_fallback.py::TestTranscribeCallSitesReadDotenv::test_transcribe_mistral_forwards_dotenv_key (PEP 668 blocks lazy mistralai install in the system Python) and tests/tui_gateway/test_goal_command.py goal-state assertions.
4. python scripts/check-windows-footguns.py agent/secret_sources/bitwarden.py hermes_cli/env_loader.py tests/test_bitwarden_secrets.py tests/test_env_loader_secret_sources.py -> no Windows footguns found.
5. Scoped lint on changed Python files with ruff check -> all checks passed.
6. git diff --check -> clean.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS/darwin-arm64 local worker

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

N/A

[konsisumer]

Closing - on reflection, Hermes treats Bitwarden as not set up and stays silent is broader than the duplicate-warning bug. If this still seems valuable, please reopen with feedback.