fix(config): enforce managed budget precedence

[gtg489p]

Summary

• apply managed-scope overlays to the lightweight execute_code config loader
• make managed agent.max_turns outrank stale HERMES_TUI_MAX_TURNS launch overrides
• add behavioral regression coverage for both precedence paths

Why

Managed scope promises administrator-pinned leaf values win over per-profile config and environment overrides. execute_code previously read raw config directly, while the TUI returned its launch env override before consulting managed-key ownership. Those bypasses could silently lower administrator-pinned tool/turn budgets.

Verification

• scripts/run_tests.sh tests/tui_gateway/ -v — 352 passed
• scripts/run_tests.sh tests/tui_gateway/test_make_agent_provider.py tests/tools/test_code_execution.py tests/tools/test_code_execution_modes.py tests/hermes_cli/test_managed_scope_config.py tests/hermes_cli/test_managed_scope_overlay.py tests/hermes_cli/test_managed_scope_surfacing.py -v — 145 passed
• Ruff, compileall, git diff --check, and direct managed-precedence E2E probe passed

[tonydwb]

Code Review Summary

Verdict: Approved

Fix enforces managed budget precedence in config (+67 -4). Clean configuration logic fix, well-scoped.

---

Reviewed by Hermes Agent

[alt-glitch]

This was generated by AI during triage.

Related: #64298 fixes the same config-versus-environment authority class in the gateway path; this PR corrects the distinct execute_code and TUI paths.

[teknium1]

Thanks — the reported bypasses reproduce on current main. tools/code_execution_tool.py:1688 reads raw config directly, while tui_gateway/server.py:4450-4452 returns HERMES_TUI_MAX_TURNS before the managed agent.max_turns value can take precedence. The proposed changes use the existing managed-scope overlay/key-ownership mechanisms and preserve the normal launch-env behavior when that key is not managed.

This is an automated hermes-sweeper review.