perf(runtime): read-only config loads + per-message provider-resolution memo - #81853

…on memo

resolve_runtime_provider() calls load_config() (a full defensive deepcopy,
~265us warm) 5-7x per call via the resolve tree — measured 74% of the
~2.35 ms/call cost — and the gateway resolver calls it 5-8x per inbound
message. Two layers fix this:

Layer A (hermes_cli/runtime_provider.py): every config read in the resolve
tree is read-only, so switch all 6 sites to load_config_readonly()
(mtime-cached, no deepcopy). _get_model_config() deep-copies only the small
model section to preserve its mutation-safety contract. Measured:
resolve_runtime_provider 2.35ms -> 0.94ms/call; _get_model_config 0.38ms ->
0.023ms/call.

Layer B (gateway/run.py): the MoA path already caches
resolve_runtime_provider behind a 300s TTL (merged MoA runtime cache,
agent/moa_loop.py); the gateway path now gets the same treatment via
_memoized_resolve_runtime, keyed on the files the resolution reads
(config.yaml + profile/global auth.json) with a TTL backstop for
env-var-only changes. Vertex (per-call OAuth token) and AuthError/fallback
results are never cached. The memo stores a copy and hands out fresh dicts
so caller mutation (pop('model')) can never corrupt it. Per-message:
~12-19ms -> ~1.5-2ms (first call resolves, the rest hit the memo).

Tests: new tests/gateway/test_runtime_resolve_fastpath.py pins the
measured-work (no deepcopy from the resolve tree, one resolve per message),
TTL/config/auth invalidation, vertex bypass, and mutation safety. Existing
tests that patched rp.load_config as their config-injection seam now patch
rp.load_config_readonly (the seam moved with the loader).

The per-message memo in _memoized_resolve_runtime() keyed on config/auth
file (mtime_ns, size) signatures only. A multiplex gateway resolves
multiple profiles' agents in the same OS process (the desktop tui_gateway
switches profiles per request via set_hermes_home_override), and
'hermes profile create --clone-all' copies the profile tree with
mtime-preserving shutil.copy2 — so a cloned profile's config.yaml/auth.json
carry the source's identical (mtime_ns, size) and compute the same memo
signature, letting one profile receive the other's cached api_key/base_url
for up to the 300s TTL.

Add str(get_hermes_home()) to the memo key, the same profile-boundary fix
open PR NousResearch#78185 applies to agent/moa_loop.py's sibling _runtime_cache.

Tests: new tests/gateway/test_runtime_resolve_fastpath_profile_isolation.py
drives _memoized_resolve_runtime under two profile overrides and asserts
each profile gets its own credentials; both tests fail without the fix and
pass with it. Same-profile memo hit preserved (2 invocations, 1 resolve).