feat(observability): add Relay client resource metrics

[afourniernv]

What does this PR do?

Adds the Category 2 client-resource slice on top of the Relay skill-metrics stack. Shared-metrics packages now include bounded Hermes version, OS family, architecture, and install-method fields captured when each aggregate is recorded.

This is a stacked draft PR on #68883. Until the earlier PRs land, GitHub shows the cumulative stack against main; the client-resource-only diff is available here.

Stack Order

1. feat(observability): integrate NeMo Relay runtime and shared metrics #67607 - core Relay runtime, task metrics, aggregation, and local export.
2. feat(observability): report model and provider usage #68881 - bounded model metrics.
3. feat(observability): aggregate bounded tool metrics #68882 - bounded tool lifecycle and approval metrics.
4. feat(observability): aggregate bounded skill metrics #68883 - skill lifecycle, provenance, reuse, and reuse-after-patch metrics.
5. This PR - bounded client OS, architecture, and install-method resources.

Merge and review in this order. This draft is cumulative until its predecessors land on main.

Related Issue

Depends on #68883.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Classify OS family, CPU architecture, and Hermes install method through closed allowlists, mapping unrecognized values to unknown.
• Persist the complete client-resource tuple with each SQLite aggregate so resource changes produce separate delta packages instead of combining counts.
• Add a transactional store migration that preserves existing counters and install identity while assigning unknown to newly introduced dimensions.
• Require the new bounded fields in the shared-metrics JSON schema and reject invalid resources before persistence.
• Extend documentation and the real Relay smoke artifact to validate resource output without exporting raw platform strings, hostnames, or paths.

How to Test

1. Run scripts/run_tests.sh tests/hermes_cli/test_relay_shared_metrics.py -q.
2. Run scripts/run_tests.sh tests/hermes_cli/test_relay_shared_metrics_runtime.py tests/plugins/test_nemo_relay_plugin.py -q.
3. Run .venv/bin/python scripts/smoke_nemo_relay_shared_metrics.py with the installed NeMo Relay binding.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS arm64

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

• Focused store and schema suite: 186 passed.
• Real Relay runtime and plugin suites: 81 passed.
• End-to-end Relay smoke: passed with all existing aggregate families and schema-valid resources (macos, arm64, git on the test host); privacy canaries remained absent.

[teknium1]

Thanks for the bounded-resource migration and compatibility coverage. I found two correctness gaps in the client-resource slice.

Problems

• hermes_cli/observability/schemas/hermes.shared_metrics.v1.schema.json:52 adds the new properties but leaves resource.required as only hermes_version (lines 43-45). The accompanying test intentionally preserves that (tests/hermes_cli/test_relay_shared_metrics.py:254-272), so schema validation does not enforce the claimed complete resource tuple.
• hermes_cli/observability/shared_metrics_subscriber.py:43 passes detect_install_method() directly into the new allowlist. The existing detector returns nix for /nix/store installs (hermes_cli/config.py:475-482), but the PR's allowlist has nixos, not nix, and normalizes unmatched values to unknown (hermes_cli/observability/shared_metrics_contract.py:188-231).

Suggested changes

• Version the strict resource schema while retaining compatibility validation for already-queued v1 packages, then test that new packages cannot omit any resource field.
• Normalize nix explicitly or add it to the contract and cover the subscriber path.

Automated hermes-sweeper review.