fix: bound threat-pattern/FTS5 regex input and cover V4A Move-File edits

[teknium1]

Summary

Bounds the regex-input surface of the threat scanner and FTS5 sanitizer so adversarial input can't induce catastrophic backtracking, and extends V4A patch handling to recognize *** Move File: headers so those edits are permissioned and traversal-checked.

Salvaged from #35130 (@jnibarger01) — the safe, design-aligned subset of that PR's security pass. The multi-tenant TUI session-scoping, gateway per-requester approval matching, and delegate_task ACP-arg stripping from the original are intentionally not carried (Hermes is a personal agent, not multi-tenant; those either fight the design or remove a documented feature).

Changes

• tools/threat_patterns.py: replace unbounded (?:\w+\s+)* filler with bounded (?:\w+\s+){0,8}, bound the .* runs in the exfil/config-mod patterns, and cap scanned input at MAX_SCAN_CHARS (64 KiB). Kills ReDoS on long near-misses; detections near the start of content preserved.
• hermes_state.py: cap FTS5 query length (MAX_FTS5_QUERY_CHARS = 2048) and extract quoted phrases via a linear scan instead of a regex, so pathological quote runs can't backtrack.
• acp_adapter/edit_approval.py + agent/tool_dispatch_helpers.py: recognize *** Move File: src -> dst V4A headers so patch-mode edits are permissioned/traversal-checked (previously only Update/Add/Delete), and surface an approval proposal for mode=patch V4A calls (previously replace-only).

Validation

	Result
tests/tools/test_threat_patterns.py	46 passed (incl. ReDoS-bound cases)
tests/agent/test_tool_dispatch_helpers.py	28 passed (incl. Move-File target)
tests/acp/test_edit_approval.py	10 passed (incl. V4A approval)
tests/test_hermes_state.py::TestFTS5Search	54 passed (incl. FTS5 cap)

Rebased onto current main; diff is exactly the 9 salvaged files. Contributor authorship preserved via the Jace Nibarger commit.

Infographic

Nous Research

[alt-glitch]

This was generated by AI during triage.

Salvage of #35130 by @jnibarger01 (the safe, design-aligned subset) — related, not a duplicate. The multi-tenant session-scoping / per-requester approval / delegate ACP-arg-stripping from the original are intentionally not carried. Also related to #41754 (omnibus V4A/ACP security pass) and #44473 (dangerous-command ReDoS bound).