fix(cli): honor personality in oneshot mode

[wo-o]

Summary

• resolve the configured personality/manual system overlay in hermes -z
• preserve HERMES_EPHEMERAL_SYSTEM_PROMPT precedence from normal CLI sessions
• add regression coverage for personality, environment override, and manual prompt fallback

Root cause

hermes -z bypasses HermesCLI and constructs AIAgent directly in hermes_cli/oneshot.py. That constructor path did not pass ephemeral_system_prompt, so display.personality and agent.system_prompt were silently ignored in one-shot mode.

Test plan

• scripts/run_tests.sh tests/hermes_cli/test_resolve_ephemeral_system_prompt.py tests/hermes_cli/test_oneshot_personality.py tests/hermes_cli/test_oneshot_usage_file.py tests/hermes_cli/test_oneshot_surrogate.py -q
• .venv/bin/ruff check hermes_cli/oneshot.py tests/hermes_cli/test_oneshot_personality.py
• live hermes -z call with a strict HERMES_EPHEMERAL_SYSTEM_PROMPT, verified in the response and by tracing the exact constructor argument

[alt-glitch]

This was generated by AI during triage.

Related: #69957 and #34863 cover the same oneshot prompt-forwarding seam. This patch uses the shared personality-aware resolver, so it has a concrete broader configuration delta; maintainer choice is needed between the open implementations.

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

fix(cli): honor personality in oneshot mode

No blocking issues found. Observations:

1. Policy tension on the new env var. hermes_cli/oneshot.py reads HERMES_EPHEMERAL_SYSTEM_PROMPT directly via os.getenv for a non-secret behavioral setting. The project policy is explicit: .env is for secrets only, and behavioral settings go in config.yaml (which this PR does support via resolve_ephemeral_system_prompt_from_config). If the env var is an internal bridge (e.g. desktop persona overlay), keep it internal-only and don't document it for users; otherwise wire it through the config→env bridge convention and add it to OPTIONAL_ENV_VARS metadata so hermes setup/hermes tools surfaces it.
2. The precedence (env override > config personality > manual agent.system_prompt) is reasonable, and the three tests cover exactly the meaningful combinations (config personality, env override, manual prompt without personality). Good regression coverage.
3. Minor: applying a personality in hermes -p "<prompt>" oneshot mode may surprise scripted callers who expect raw output — the config-gated default (only when display.personality is set) preserves that, which is good; just confirm the docs mention the env override can force it off.