fix(config): parse list literals in config set; tolerate string-typed scan roots

[gtmacdonald]

Symptom

hermes config set desktop.repo_scan_roots '["~/src"]' stores the value as a quoted string, not a list:

desktop:
  repo_scan_roots: '["/Users/me/src"]'

The desktop repo-discovery policy loader (_repo_discovery_policy in tui_gateway/server.py) guards with isinstance(roots, list), so the string fails the check and silently falls back to the default roots: [] — which means "scan all of $HOME". The discovered_repos cache then keeps refilling with every git checkout under the user's home (old coursework, backups, vendored trees), and stale entries keep resurfacing in the desktop Projects sidebar no matter how often the cache is purged. No warning is emitted anywhere; the persisted policy in projects.db (repo_discovery_policy → "roots":[]) is the only visible evidence.

Hit this in the wild: configured scan root ignored, 40+ junk repos resurfacing in the picker after every purge.

Fix (both sides of the bug class)

Write side — hermes_cli/config.py set_config_value: values starting with [ / { for non-string-typed keys are parsed with fast_safe_load and stored as real YAML collections. String-typed keys (e.g. display.skin) keep literal text — the existing enum-preservation contract is untouched. Malformed literals stay strings (historical behavior).

Read side — tui_gateway/server.py _repo_discovery_policy: new _coerce_scan_path_list helper heals a string-typed list literal already sitting in user config (logs a warning telling the user to re-save), accepts a bare path string as a one-element list, and only falls back to defaults for genuinely unusable values. Existing broken configs written by older CLI versions stop silently scanning $HOME.

Tests

9 new tests, all asserting behavior contracts (no snapshots):

• tests/hermes_cli/test_set_config_value.py — list literal → real YAML list; empty list; string-typed default keeps literal text; malformed literal stays a string
• tests/tui_gateway/test_projects_rpc.py — string literal parsed; bare path → one-element list; real list unchanged; garbage falls back to default; excludes get the same treatment

scripts/run_tests.sh tests/hermes_cli/test_set_config_value.py tests/tui_gateway/test_projects_rpc.py tests/hermes_cli/test_desktop_repo_discovery_config.py
=== Summary: 3 files, 112 tests passed, 0 failed ===

Branch is cut from current upstream/main (73997c4).

[teknium1]

Resolved via PR #88163 (merged) — hermes config set now parses structured list/dict values (yaml.safe_load, string-typed-key guard respected, conservative trigger). This was an 8-PR duplicate cluster: first submitter was @liuhao1024 (#37460), and the merged base was #59182 (@sam7894604) with authorship preserved; all cluster authors are credited in the PR body. Thanks for taking a run at it!