session_search: honor session_search.protected profile config flag

[MrB0req]

What

A profile can now opt out of being visible to other profiles' session_search by declaring in its own config.yaml:

session_search:
  protected: true

• _resolve_profile_db rejects direct reads of a protected profile by any other profile (same error channel as "profile does not exist").
• _locate_session_db skips protected profiles when scanning for a bare session id.
• The restriction hangs on the target, not the caller: the protected profile itself can still search everyone as before (one-way glass).
• A broken or missing target config counts as unprotected, so someone else's malformed YAML can never break your search (logged at debug level).

Why

In multi-profile deployments some profiles hold conversations of a fundamentally different sensitivity class (e.g. a personal/mental-health assistant next to infra bots). Today every profile can read every other profile's state.db through session_search — there is no permission layer at all. This adds a minimal, config-driven one.

Tests

New tests next to the existing session_search suite (tmp profiles-root + monkeypatched HERMES_HOME): caller→protected target rejected, target reads itself fine, protected caller reads others fine, locate-scan skips protected profiles, broken config treated as unprotected. Full file: 59 passed.

🤖 Generated with Claude Code

[teknium1]

Thanks for covering both the explicit-profile and bare-ID lookup paths; current main does expose cross-profile sessions through tools/session_search_tool.py:144-208.

Problems

• The normal agent dispatchers omit profile before calling session_search: agent/tool_executor.py:1193-1202 (sequential) and agent/agent_runtime_helpers.py:2226-2235 (concurrent). The schema advertises this argument at tools/session_search_tool.py:885-892, so the new direct-call tests do not prove the stated explicit-profile behavior for model tool calls.
• The added tests call session_search() directly with monkeypatched profile helpers. Add execution-path coverage with a real temporary profile root/HERMES_HOME so this integration boundary is exercised.

Suggested changes

• Forward profile=next_args.get("profile") in both inline dispatchers and add protected/unprotected regression coverage through both dispatch paths.
• Document that this controls session_search visibility only; profiles are not filesystem sandboxes (website/docs/user-guide/profiles.md:125-133).

This is an automated hermes-sweeper review.