perf(runtime): read-only config loads + per-message provider-resolution memo

[spfcraze]

What does this PR do?

resolve_runtime_provider() deep-copies the whole config 5-7x per call (measured 74% of its 2.35ms/call cost) and the gateway resolver calls it 5-8x per inbound message (~12-19ms of CPU before every LLM call). The MoA path already caches it behind a 300s TTL (#66793); the gateway path never got that. Fix: (A) convert all 6 read-only config reads in the resolve tree to load_config_readonly() (mtime-cached, no deepcopy), deep-copying only the small model section in _get_model_config to preserve its mutation contract — measured 2.35ms->0.94ms/call; (B) add _memoized_resolve_runtime at the gateway per-message entry, keyed on config+auth mtimes with a 300s TTL backstop, never caching the vertex OAuth path or fallback results — measured 0.94ms->0.149ms on memo hit. Per-message cost drops ~10x. 12 new measured-work/behavior-parity tests; sabotage PASS.

Related Issue

No GitHub issue — discovered via code review and reproduced live (see below). Happy to file one first if preferred.

Changes Made

• fix/provider-runtime-fastpath — 9 file(s) changed vs base:
  • gateway/run.py
  • hermes_cli/runtime_provider.py
  • tests/agent/test_bedrock_adapter.py
  • tests/agent/test_nous_portal_anthropic_wire.py
  • tests/gateway/test_runtime_resolve_fastpath.py
  • tests/hermes_cli/test_canonical_custom_identity.py
  • tests/hermes_cli/test_custom_provider_identity.py
  • tests/hermes_cli/test_runtime_provider_resolution.py
  • tests/tui_gateway/test_custom_provider_session_persistence.py

How to Test

Validation completed:

1. Sabotage check: pre-fix code fails the regression tests (8 failed), with the fix all pass (12 passed, 0 failed) — target tests/gateway/test_runtime_resolve_fastpath.py.
2. Suite <full suite>: branch 27401 passed / 6 failed vs baseline 27387 passed / 8 failed — zero branch-only failures.
3. The full repo-wide suite was run (item 2); GitHub CI remains the final confirmation environment.

Logs

Sabotage verification output:

# base leg (pre-fix code + branch tests):
#   tests: 4 passed, 8 failed
# head leg (with fix):
#   tests: 12 passed, 0 failed

[spfcraze]

this is the same profile-boundary gap #78185 closes for agent/moa_loop.py's sibling cache, and my gateway memo had the identical flaw. Fixed in 189c7b2.

What changed: _runtime_resolve_memo_signature() now leads the memo key with str(get_hermes_home()), so the key is (hermes_home, config sig, profile auth sig, global auth sig) — mirroring #78185's (hermes_home, provider, model) pattern. A multiplex gateway resolving profiles A and B in the same process can no longer collide on cloned profiles whose config.yaml/auth.json share (mtime_ns, size) (mtime-preserving shutil.copy2 from --clone-all); each profile gets its own memo slot and its own resolved api_key/base_url.

Verification:

• New tests/gateway/test_runtime_resolve_fastpath_profile_isolation.py drives _memoized_resolve_runtime() under two profile overrides and asserts each profile receives its own credentials. Both tests fail without the fix (profile B receives profile A's cached key) and pass with it — same proof style as fix(moa): scope the per-slot runtime cache to the active profile #78185's test_profile_isolation_runtime.py addition.
• test_signature_includes_hermes_home asserts the signature differs between profiles even when the config/auth files are byte-identical.
• No perf regression: the same-profile memo hit is still pinned (2 invocations → 1 resolve call) by test_second_resolve_hits_memo.
• Full affected surface green: 76 tests across the fastpath, profile-isolation, runtime-resolution, and session-override suites; CI on the fixed head is green.