fix(cli): don't warn on plugin toolsets; skip kanban TERMINAL_CWD deprecation

[mattamundson]

Summary

Two startup false-positives that spam every kanban worker log (and any CLI run that enables a plugin toolset):

1. cli.py — 'Unknown toolsets: omh' for plugin toolsets. HermesCLI validates toolset names at startup, but plugin toolsets are registered during plugin load, which happens after this validation — the same timing problem as MCP server names, which were already excluded (see existing mcp_names exclusion). This PR excludes names declared in known_plugin_toolsets.<platform> the same way.

2. hermes_cli/config.py — spurious TERMINAL_CWD deprecation warning in kanban workers. warn_deprecated_cwd_env_vars() warned that TERMINAL_CWD was a stale .env entry. Kanban workers deliberately pin TERMINAL_CWD to the task workspace (kanban_db.py worker spawn) so file tools and context-file loading anchor on the workspace. Workers are marked with HERMES_SESSION_SOURCE=kanban; the warning now skips that case only.

Motivation

A kanban worker task (t_fc43cdca) crashed twice at startup in July because its required skill was missing — but the only content in the worker log was these warning lines, which made the real error hard to spot. Clean worker logs make kanban diagnostics readable.

Verification

• python -m py_compile cli.py hermes_cli/config.py — clean.
• With default profile: invalid = [] for platform_toolsets.cli (omh no longer flagged).
• Fresh kanban worker dispatch (run 9, smoke task) produced a log with neither warning.
• Normal CLI behavior unchanged (non-worker TERMINAL_CWD warnings still fire).

[cYoren]

#88003 — Verified mergeable: fix CLI false-positive warnings for plugin toolsets and kanban worker TERMINAL_CWD

Verdict: MERGE. Both changes correctly scoped; behavior verified; minor non-blocking test gap.

Two independent false-positive fixes, both traced against real code:

1. Plugin toolsets no longer reported "Unknown". CLI toolset validation runs before plugin load, so a toolset a plugin will register is (correctly) still unknown at that moment → spurious warning. The fix excludes names from known_plugin_toolsets[cli] alongside the existing mcp_names exclusion. Shape verified: hermes_cli/tools_config.py:2489,2643 writes known_plugin_toolsets[platform] = sorted(plugin_keys), so .get("cli") or [] is the correct accessor.

2. Kanban workers no longer warned about TERMINAL_CWD. hermes_cli/kanban_db.py:10405 sets HERMES_SESSION_SOURCE = "kanban" when spawning a worker — exactly the marker used here — and kanban workers legitimately pin TERMINAL_CWD to the task workspace (a runtime bridge, not a stale .env entry).

Behavioral verification (worktree, PR head 353f08ac0)

• python3 -m pytest tests/hermes_cli/test_deprecated_cwd_warning.py tests/test_toolsets.py -q → 27 passed.
• Kanban marker + TERMINAL_CWD set, no config cwd → warning suppressed (old code would warn).
• Non-kanban + TERMINAL_CWD set → warning still present (no over-suppression).

Scoped correctly: the suppression is gated on the specific HERMES_SESSION_SOURCE=kanban marker, so ordinary users still get the deprecation notice.

Non-blocking

No test covers either new branch (known_plugin_toolsets isn't referenced anywhere in tests/; no kanban-worker case in tests/hermes_cli/test_deprecated_cwd_warning.py). The 27 passing tests predate the PR (they assert pre-existing behavior) and only prove no regression, not the new suppression. Worth adding one test each (a plugin-toolset-unknown case and a HERMES_SESSION_SOURCE=kanban cwd case) to lock the fix in.