fix: guard against list-valued keys in hermes config set (#76138)

[RelaxJonh]

Problem

hermes config set always writes a scalar value. When the target key is list-typed (e.g. toolsets, plugins.enabled, terminal.env_passthrough), the command silently writes a quoted YAML string instead of a YAML sequence, corrupting the config.

# What gets written (broken):
plugins:
  enabled: "[local_model_warning]"   # string, NOT a list

# What should exist:
plugins:
  enabled:
    - local_model_warning

The corrupted config silently breaks downstream consumers that iterate the value as a list.

Fix

Add a pre-write guard in set_config_value that checks:

1. The existing value in user config
2. The declared default in DEFAULT_CONFIG via _default_value_for_key()

When either is a list, refuse the write with a clear error message:

✗ 'toolsets' is a list-valued setting.  `hermes config set` writes a
  scalar and would corrupt it (quoted string instead of YAML list).
  Edit config.yaml directly, or use `hermes config edit`.

The guard covers both bare keys and dotted keys. --force bypasses it for scripted use.

Testing

• All 39 existing config_set tests pass
• The guard correctly rejects hermes config set plugins.enabled foo when the key is list-typed
• --force allows the write through

Closes #76138

[alt-glitch]

This was generated by AI during triage.

Related to #76139: both address scalar corruption of list-valued config settings, but this PR refuses the write while #76139 parses list input. Maintainer policy choice needed; not a duplicate.

[teknium1]

Thanks for targeting a real config-corruption path. Current main passes a string through set_config_value to _set_nested (hermes_cli/config.py:4869-4880, :4948), so list-shaped CLI input can indeed persist as a scalar.

Problems

• The proposed refusal also rejects the documented hermes config set toolsets '["hermes-cli", "browser"]' workflow at website/docs/user-guide/features/browser.md:422. The PR needs a maintainer decision between updating that contract or parsing supported list input; the related-PR discussion already identifies this distinction.
• The diff changes only hermes_cli/config.py; it adds no regression tests. Existing tests cover list-index navigation (tests/hermes_cli/test_set_config_value.py:198) and mapping replacement (:574), not this list-leaf guard.
• --force gains a list-overwrite bypass, while its parser help still says it only skips the unknown-key notice (hermes_cli/subcommands/config.py:43-47).

Suggested changes

• Resolve the documented list-input behavior, add rejection/force regression tests, and update --force help if the bypass remains.

Automated hermes-sweeper review.

[teknium1]

This guard rejects the documented hermes config set toolsets '["hermes-cli", "browser"]' workflow (website/docs/user-guide/features/browser.md:422). Please either parse that supported list syntax here or update the documentation after confirming refusal is the intended UX.