fix(auth): tolerate legacy Codex suppression data

[DanDo385]

What does this PR do?

Fixes a legacy auth-store compatibility crash during hermes auth remove openai-codex CREDENTIAL_ID.

Older stores can represent suppressed_sources[provider] as a mapping. Removing a registered Codex credential then reached .append() on that mapping and raised AttributeError. The removal path now normalizes mapping keys into the canonical list form before adding the requested source.

Related Issue

No exact duplicate issue or PR found. Related auth-removal work does not cover the legacy mapping-shaped suppression value.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/auth.py: normalize legacy mapping-shaped provider suppression data to a list before source suppression is appended.
• tests/hermes_cli/test_auth_commands.py: add a regression covering removal of a Codex credential from a legacy auth store, canonical persisted markers, and an empty resulting pool.

How to Test

1. Create an auth.json with a pooled openai-codex credential from manual:device_code and legacy data such as "suppressed_sources": {"openai-codex": {"legacy": true}}.
2. Run hermes auth remove openai-codex CREDENTIAL_ID with that store as HERMES_HOME.
3. Confirm removal succeeds and persists suppressed_sources["openai-codex"] as a list containing the legacy key and Codex suppression markers.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 13.7.8

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A: N/A; behavior is a backward-compatibility fix and the helper docstring documents the legacy shape.
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A: N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A: N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A: reviewed scripts/check-windows-footguns.py --diff origin/main; its 12 reports are pre-existing calls in the touched test file and the new file read declares UTF-8.
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A: N/A; no command syntax or schema changed.

Screenshots / Logs

Focused CI-parity tests passed:

scripts/run_tests.sh tests/hermes_cli/test_auth_commands.py tests/hermes_cli/test_auth_xai_oauth_provider.py -q
43 passed

Manual CLI proof passed with a temporary HERMES_HOME:

Removed openai-codex credential #1 (qb)
Suppressed openai-codex device_code source
suppressed_sources: ["legacy", "device_code", "manual:device_code"]

git diff --check origin/main...HEAD passed.

Full-suite blocker

The full suite was attempted in a fresh external Python 3.11.15 environment with .[all,dev] installed, then stopped after confirming two failures that reproduce unchanged on clean upstream main:

• tests/agent/test_anthropic_output_field_leak.py: imports stale code from ~/.hermes/hermes-agent, which lacks get_process_hermes_home.
• tests/agent/test_credential_pool_routing.py::TestFailureAttribution::test_unmatched_key_does_not_retry_only_pool_entry: expects recovered is False; clean upstream main returns True.

The full-suite checkbox remains unchecked. This PR is Draft until those unrelated upstream/environment failures have a project-approved disposition.

[DanDo385]

Superseded by #83278. The replacement is rebased on current main, uses the correct fix/auth-legacy-codex-suppression branch name, and contains only the legacy suppression compatibility fix plus its regression test.