feat(gateway): composable output-guard pipeline + non-blocking suggest_actions tool

[jeffreyhlin]

Summary

Two related extension points at the gateway's outbound seam, both generalizing
patterns that already existed as one-off code paths.

1. Composable output-guard pipeline (gateway/output_guards.py)

Three outbound checks previously lived as separate inline code paths:

• secret redaction (_redact_gateway_user_facing_secrets)
• provider-error rewriting (_looks_like_gateway_provider_error)
• silence-narration drop (_is_silence_narration in delivery.py)

This folds them into one ordered, fault-isolated validator chain. A guard is a
(text, ctx) -> GuardOutcome | None callable that can rewrite or drop a
message; a drop short-circuits the rest. Guards may be sync or async. The
pipeline never raises: a guard that throws is logged and skipped, so a buggy
rule can never block delivery.

Wired into the two existing chokepoints (_sanitize_gateway_final_response
for agent replies, DeliveryRouter._deliver_to_platform for cron deliveries),
both with fallbacks to the legacy inline path.

Two new guards ship off by default, enabled via gateway.guards.* in
config.yaml (no new env vars):

• strip_em_dashes — style rule as a guard
• verify_links — async; never emit a URL that doesn't resolve

Adding a rule is now one function plus one registry entry, instead of another
inline branch at a call site.

2. suggest_actions tool — non-blocking tappable follow-up actions

Generalizes the clarify interaction pattern. Where clarify blocks the
agent on an A/B/C question, suggest_actions is fire-and-forget: the agent
attaches up to 6 actions to a message and finishes its turn. Tapping one starts
a new turn seeded with that action's payload.

• tools/suggest_actions_tool.py — schema + validation/normalization
• tools/suggested_actions_gateway.py — non-blocking registry
  (register/resolve/eviction/session-cleanup). No blocking Event, no timeout
  thread; a per-session cap bounds memory without a reaper.
• gateway/platforms/base.py — default numbered-list text fallback, so every
  platform degrades gracefully
• plugins/platforms/telegram/adapter.py — native inline buttons
  (sa:<set_id>:<index>); a tap resolves the payload server-side (Telegram
  caps callback_data at 64 bytes) and injects a synthetic MessageEvent
  through the normal handle_message entry point

Any turn that would end in "want me to do X or Y?" can become tappable, so
recommendation cards, cron confirmations, and snooze shortcuts all get the
affordance for free.

Registered in the existing clarify toolset rather than a new one, so the
core tool-schema footprint grows by exactly one tool.

Notes for review

• No new HERMES_* config env vars; both new guards read config.yaml. The
  HERMES_GUARD_* vars are test/debug overrides only.
• Prompt caching, message-role alternation, and the system prompt are
  untouched.
• The suggest_actions dispatch goes through
  _run_agent_tool_execution_middleware, matching the surrounding tools.
• _provider_error_guard deliberately applies to all chat surfaces, not
  just Telegram, per the widened invariant in fix(gateway): quiet noisy Telegram errors and sanitize provider failures #28533 -> [Bug]: Gateway status/error sanitization is Telegram-only — WhatsApp/Discord/Slack/Signal leak internal noise to users #39293. Programmatic
  surfaces are excluded upstream by _GATEWAY_RAW_TEXT_PLATFORMS.

Tests

30 new tests (tests/gateway/test_output_guards.py,
tests/tools/test_suggest_actions.py) covering pipeline mechanics
(rewrite/drop/short-circuit/fault-isolation/sync-vs-async), each built-in
guard, tool validation, and registry lifecycle including eviction.

Verified green together with the suites this touches:

tests/gateway/test_output_guards.py tests/tools/test_suggest_actions.py
tests/gateway/test_telegram_noise_filter.py tests/gateway/test_delivery.py
tests/gateway/test_delivery_silence_filter.py tests/test_toolsets.py
tests/tools/test_clarify_tool.py tests/tools/test_clarify_gateway.py
-> 846 passed

Assertions target behavior contracts rather than snapshots (e.g. the secret
test asserts the raw credential does not survive, not a specific mask marker,
since agent.redact masks with *** while the gateway fallback uses
[REDACTED]).