fix(cli): strip ASCII control characters in save_env_value

[GauravPatil2515]

Summary

save_env_value() only removed \\n and \\r before writing credential values to ~/.hermes/.env. Other ASCII control characters (C0 range, 0x00-0x1F, and DEL, 0x7F) could still be persisted.

• On Windows, saving a copied key containing a NUL byte causes os.environ[key] = value to crash with ValueError: embedded null character, leaving a partially written and dirty .env file.
• On other systems, control bytes such as TAB or DEL survive, resulting in confusing request authorization/header failures at request time.

Fix

Strip all ASCII control characters (0x00-0x1F and 0x7F) from values in save_env_value() before performing other validations or writes. This also handles the previous \\n and \\r removal.

Tests

Adds test_save_env_value_strips_ascii_control_characters to verify NUL, TAB, CR, LF, DEL, etc. are stripped cleanly from both process env and loaded env.

Fixes #55335

[alt-glitch]

This was generated by AI during triage.

Duplicate of #55336 — same code site (save_env_value() in hermes_cli/config.py) and same mechanism (strip ASCII control chars before writing credentials to ~/.hermes/.env). #55336 (opened ~6h earlier) is the earliest-open canonical fix for #55335. Also related to the earlier competing fix #40887 (keeps TAB, adds *_URL/_HOST/_ENDPOINT validation). Flagging for the maintainer to consolidate.

[teknium1]

Thanks for the focused regression fix. The premise is confirmed on current main: save_env_value() still performs only CR/LF normalization at hermes_cli/config.py:7554, writes .env at hermes_cli/config.py:7601, and assigns os.environ afterward at hermes_cli/config.py:7618. The proposed filter runs before both operations and correctly excludes C0 controls plus DEL.

The surrounding file moved since the PR base, but the target statement remains materially unchanged, so salvage is a small mechanical reapplication. The member triage comment and #55336 identify an earlier competing implementation of the same fix; that consolidation choice remains for maintainers.

Automated hermes-sweeper review.