fix: unblock Codex fallback and stabilize skill update hashes

[nicogentico]

Summary

• Let OpenAI Codex usage_limit_reached errors decline credential-pool recovery so configured fallback providers can activate immediately.
• Pass error context into the eager fallback pool-recovery decision path.
• Align skills hub in-memory bundle hashing with on-disk content_hash path ordering, fixing false update_available reports for skills that contain both references/styles.md and files under references/styles/.

Why

Two update-time issues surfaced in a real Hermes install:

1. Codex subscription quota exhaustion (usage_limit_reached) is not recoverable by rotating credentials inside the same pool. Treating it like a pool-recoverable rate limit can delay or block fallback to OpenRouter.
2. bundle_content_hash() and content_hash() intended to be symmetric, but sorted paths differently when a file and directory share a prefix. This made an installed skill with identical contents still appear outdated.

Test Plan

• python -m pytest tests/agent/test_credential_pool_routing.py -q -o 'addopts='
• python -m pytest tests/tools/test_skills_hub.py::TestCheckForSkillUpdates tests/agent/test_credential_pool_routing.py -q -o 'addopts='
• Manual verification: hermes skills check now reports 0 update(s) available after force-installing baoyu-article-illustrator.

[teknium1]

Thanks for the focused regression coverage. The skill-hash half addresses a current asymmetry: disk hashing sorts Path values in tools/skills_guard.py:695, while bundle hashing still sorts raw strings in tools/skills_hub.py:3692.

Problems

• The Codex bypass is unsafe as a provider-wide rule. hermes_cli/auth_commands.py:316-324 creates one self-contained pool entry per Codex account. Skipping recovery on every usage_limit_reached would bypass a second independent account. Current main intentionally rotates immediately for this signal in agent/agent_runtime_helpers.py:833-855 (commit 80fa92a491c67ae98c43ea723487db640d99857f).
• The fallback plumbing has moved: current main gates fallback through agent/conversation_loop.py:3203-3208, and that helper no longer accepts error context.

Suggested changes

• Split and port the hash-order fix with its regression test.
• Rework the Codex part to retain multi-account rotation, or establish a verified account-identity condition before bypassing the pool; cover the current conversation-loop fallback path.

Automated hermes-sweeper review.