fix(config): strip control chars from saved credentials

[tianma-if]

What does this PR do?

Fixes save-time credential normalization so save_env_value() strips ASCII control characters before writing ~/.hermes/.env and before mutating os.environ. This prevents copied API keys/tokens containing hidden bytes such as NUL, TAB, or DEL from leaving a malformed .env behind or crashing with ValueError: embedded null character.

Fixes #55335

Type of Change

• Bug fix
• Tests

Changes

• Adds _check_ascii_control_credential() beside the existing non-ASCII credential sanitizer.
• Routes save_env_value() through the printable-ASCII sanitizer before .env serialization and os.environ assignment.
• Adds regression coverage proving NUL/TAB/DEL are stripped from both the persisted .env bytes and the process environment.
• Leaves existing .env load-time non-ASCII sanitizer semantics unchanged; this PR targets the save path described in the issue.

How to Test

• .venv/bin/python -m pytest tests/hermes_cli/test_non_ascii_credential.py -q
• .venv/bin/python -m pytest tests/hermes_cli/test_env_load_cache.py tests/hermes_cli/test_env_loader.py tests/hermes_cli/test_config.py -q -k "env or credential or API_KEY or denylisted"
• .venv/bin/python -m ruff check hermes_cli/config.py tests/hermes_cli/test_non_ascii_credential.py
• git diff --check

Platform: macOS, Python 3.13, local .venv.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #55336 (earliest open, canonical) — both strip ASCII control characters in save_env_value() (hermes_cli/config.py) before writing ~/.hermes/.env / mutating os.environ, closing #55335. Same code site and mechanism (minor delta: this PR keeps TAB). #55767 is the same fix; #40887 is an earlier competing fix with broader scope (URL validation). A maintainer should pick one.

[tianma-if]

Closing as duplicate of #55336 per triage; the earlier PR covers the same save_env_value control-character fix. Thanks.