feat: support Bitwarden env alias mapping

[Kaluanbernardo]

Summary\n- Add secrets.bitwarden.env_map to materialize profile-specific BWS secret aliases as runtime env vars\n- Add prune_env_keys/prune_env_prefixes so alias secrets do not remain in long-lived process env after mapping\n- Cover Discord multi-profile token aliasing with env-loader tests\n\n## Tests\n- uv run --with pytest --with pyyaml --with python-dotenv python -m pytest tests/test_bitwarden_secrets.py tests/hermes_cli/test_env_loader_bitwarden_env_map.py -q -o 'addopts='\n

[alt-glitch]

This was generated by AI during triage.

Related: part of the Bitwarden profile-scoped-secrets cluster with the open #51616 (canonical-aliasing in bitwarden.py) and #50686 (key_prefix/strip_prefix). This PR takes a different mechanism — env_loader-level secrets.bitwarden.env_map aliasing + env pruning — so it competes rather than duplicates. Maintainer should pick the preferred layer.

[teknium1]

Thanks for addressing a real profile-scoped secret problem. The current implementation needs to move to the active secret-source path before it can be salvaged.

Problems

• hermes_cli/env_loader.py:341-346 now delegates secret startup to registry.apply_all(), which writes raw fetched names at agent/secret_sources/registry.py:339-368. The added mapping call is attached to the pre-registry direct Bitwarden path and therefore does not reach the current gateway startup flow.
• The new tests mock legacy apply_bitwarden_secrets; current active-loader tests mock fetch_bitwarden_secrets and exercise _apply_external_secret_sources() (tests/test_env_loader_secret_sources.py:91-105).
• The proposed settings are not represented in BitwardenSource.config_schema() (agent/secret_sources/bitwarden.py:616-640) or the Bitwarden config docs/example.

Suggested changes

• Rework mapping in the active BitwardenSource/registry flow, preserving registry precedence, protected variables, and provenance.
• Add an active-loader regression that proves gateway/config.py:1501-1504 receives canonical DISCORD_BOT_TOKEN and aliases are absent.
• Coordinate the mapping contract with related open PRs #51616 and #50686 before defining docs/config surface.

Automated hermes-sweeper review.

[teknium1]

Current main no longer has this direct Bitwarden-result path: hermes_cli/env_loader.py:341-346 calls registry.apply_all(), which owns the actual environment writes. Please move aliasing into the active SecretSource/registry flow so it preserves precedence, protected-variable handling, and provenance.

[teknium1]

This mocks the legacy apply_bitwarden_secrets entry point. Current startup tests stub fetch_bitwarden_secrets and exercise _apply_external_secret_sources() through the registry; use that live path so the test covers the implementation users run.