fix: guard remaining float(os.getenv) casts against malformed values

[vanthinh6886]

Summary

run_agent.py and hermes_cli/auth.py have bare float(os.getenv(...)) calls that raise ValueError on malformed input (e.g. "abc", "").

Fix

Wrap in try/except (TypeError, ValueError) to fall back to the default value, matching the pattern already used throughout the codebase.

Changes

• run_agent.py: HERMES_API_TIMEOUT (line 1112)
• hermes_cli/auth.py: HERMES_CODEX_REFRESH_TIMEOUT_SECONDS (line 3841), HERMES_XAI_REFRESH_TIMEOUT_SECONDS (line 4478)

[alt-glitch]

Related: #45521 (guards the same HERMES_API_TIMEOUT cast in run_agent.py with the identical inline try/except) and #48773 (guards the same two HERMES_*_REFRESH_TIMEOUT_SECONDS casts in hermes_cli/auth.py, via an env_float() helper). This PR covers the union of those two sites; no new call site beyond what those earlier open PRs already address. Part of the broader env-var malformed-value hardening series (#48771, #48776, #48778, #49429).

[kshitijk4poor]

Closing as superseded by #49558, which landed the canonical fix for this whole bug class.

#49558 adds env_float() alongside the existing env_int() in utils.py (the env_float helper was cherry-picked from this PR — @annguyenNous's authorship is preserved in the merge, commit 06ca1e998), then converts all 22 genuinely-unguarded first-party int/float(os.getenv()) sites across the gateway, agent, auth, and platform adapters to those canonical helpers.

We went with the utils.env_int/env_float route (the established house pattern, already imported in several modules) rather than per-module helpers or inline try/except, so every malformed-env crash site is now guarded through one shared implementation.

Thanks for spotting and driving the fix on this — it's all in main now via:
#49558