fix: filter invalid MoA slot providers

[iniak]

Summary

• exclude unconfigured providers from the CLI MoA slot picker
• exclude the virtual moa provider so an aggregator cannot accidentally recurse and fall back to OpenRouter
• add regression coverage for picker filtering

Root cause

The CLI MoA picker included setup-only providers and the virtual moa provider. Selecting the latter is rejected as recursive MoA and falls back to the default aggregator, which can route users to OpenRouter unexpectedly.

Validation

• exercised the picker against the local authenticated-provider inventory
• verified the configured OpenCode Go slot remains selected
• pytest was unavailable in the bundled Hermes virtualenv

[teknium1]

Thanks for the focused regression fix. Current main still exposes every non-empty inventory row through the MoA slot picker (hermes_cli/moa_cmd.py:29-40), while the inventory injects the virtual moa row independently (hermes_cli/inventory.py:184-186). Existing validation rejects that provider for saved slots (hermes_cli/moa_config.py:99-105), so excluding it before selection is the correct layer.

The added regression test covers both changed behaviors: forwarding include_unconfigured=False and filtering the virtual provider. Current-main staleness is mechanical: the only later moa_cmd.py change is the separate formatting helper from 3dca75b45.

Automated hermes-sweeper review.

[teknium1]

Merged via cluster PR #70282 (commit 9b868f6) — your commit cherry-picked from the draft with authorship preserved (we took it out of draft state as part of the cluster; the include_unconfigured=False behavior change was flagged to the maintainer in the PR body and accepted). Thanks!