fix(auth): apply newer hosted bootstrap session

[benbarclay]

Resolves #64610.

Production evidence

Time (UTC)	Event
19:50:51	NAS minted a replacement hosted-agent bootstrap session and revoked the previous session.
19:51:41	Container boot logged [rebootstrap] no-op (not_terminal) because the local old tokens still looked healthy.
19:51:53	The old refresh session was rejected with invalid_grant: Refresh session has been revoked.
19:51:54	Hermes quarantined the OAuth state, causing NAS to start another self-heal cycle.

The affected hosted instance recorded 74 uptime resets in the sampled four-day window.

Root cause

NAS issues the replacement before restart and revokes the prior session. The boot helper only accepted HERMES_AUTH_JSON_REBOOTSTRAP after the local entry had already been quarantined. A still-present access/refresh token therefore made the helper reject the new seed, even though NAS had already revoked that local session.

Changes

• Apply an orchestrator rebootstrap seed when its obtained_at is strictly newer than the local session.
• Preserve the existing terminal-quarantine recovery path.
• Refuse older, equal, malformed, or incomparable timestamps, preventing a retained env value from rolling healthy rotated credentials backward.
• Add a distinct reseeded_newer breadcrumb for production verification.
• Update the stage2 contract documentation and regression coverage.

Verification

• uv run --quiet --with pytest python -m pytest tests/tools/test_docker_rebootstrap_nous_session.py tests/hermes_cli/test_nous_session_validity.py tests/hermes_cli/test_auth_nous_provider.py -q — 100 passed
• uv run --quiet --with ruff==0.15.10 ruff check scripts/docker_rebootstrap_nous_session.py tests/tools/test_docker_rebootstrap_nous_session.py — clean
• bash -n docker/stage2-hook.sh — clean
• python -m compileall -q scripts/docker_rebootstrap_nous_session.py tests/tools/test_docker_rebootstrap_nous_session.py — clean
• git diff --check — clean

Expected production impact

After NAS pushes a newly minted hosted bootstrap session, the first boot applies it instead of retaining the revoked predecessor. The follow-up refresh should succeed and the self-heal restart chain should stop after one cycle.

Trace-point suggestions

• Include local and seed obtained_at plus the rebootstrap decision (terminal, newer, stale, incomparable) in the boot breadcrumb.
• Include the affected profile/home path in nous_session_valid and NAS remint telemetry so profile-scoped auth failures are attributable without SSH inspection.

Not in this PR

• No change to NAS lifecycle ordering or its Redis loop guard.
• No change to profile-specific auth recovery; this fixes the verified root-session revocation loop without widening credential writes across profile boundaries.

[benbarclay]

Independent review caught a blocking seed-validation gap. Follow-up commit fb74a75 now requires client_id=hermes-cli-vps plus non-empty access and refresh tokens before replacing healthy credentials; timezone-less, malformed, extreme, older, and equal timestamps remain incomparable/no-op. Fresh verification: 100 relevant tests passed; Ruff, shell syntax, compileall, and diff checks passed.