feat(terminal): wire docker_network through docker backend

[malaiwah]

What does this PR do?

Adds terminal.docker_network for the Docker terminal backend and wires it through to docker run --network <name> when set.

This makes it possible to run Hermes on a specific Docker/Podman network so sandbox containers can resolve and talk to sibling services on that network. The behavior stays conservative: empty/unset keeps the current default behavior, and network=False still wins and forces --network=none.

Related Issue

Fixes #4921

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• add terminal.docker_network to config defaults and config-to-env sync
• bridge TERMINAL_DOCKER_NETWORK through CLI config loading and terminal tool config parsing
• pass the value through terminal_tool() into DockerEnvironment
• add Docker runtime precedence so network=False still overrides a named network
• add regression tests for config sync, env parsing, terminal tool pass-through, and Docker run args

How to Test

1. Set terminal.backend to docker.
2. Set terminal.docker_network to a named Docker network such as hermes-net.
3. Run a Docker-backed terminal command and verify the sandbox can resolve or reach services on that network.
4. Verify direct DockerEnvironment(..., network=False, docker_network="hermes-net") still uses --network=none.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.2

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Focused validation is green:

• python -m pytest tests/tools/test_parse_env_var.py tests/tools/test_docker_environment.py tests/tools/test_modal_sandbox_fixes.py tests/hermes_cli/test_set_config_value.py -q
• 73 passed

I also ran python -m pytest tests/ -q, but the full suite does not currently pass cleanly in this checkout. The failures I saw were outside the files touched in this PR.

[malaiwah]

Validation note:

• focused slice is green: python -m pytest tests/tools/test_parse_env_var.py tests/tools/test_docker_environment.py tests/tools/test_modal_sandbox_fixes.py tests/hermes_cli/test_set_config_value.py -q -> 73 passed
• full suite result in this checkout: 7883 passed, 172 skipped, 1 xfailed, 9 failed
• the full-suite failures I saw were outside the files touched in this PR

[teknium1]

Closing — this functionality landed on main via PR #59149 (salvage of #46358): terminal.docker_network is now bridged through cli.py, gateway/run.py, and hermes_cli/config.py, wired through the terminal/file/code-exec container paths, and guarded on container reuse. You had the same wiring idea back in April and were the first to submit it — sorry it sat this long, and thanks for the contribution.