fix(gateway): honor profile toolset capabilities

[TheTom]

What does this PR do?

Completes the runtime side of the profile capability editor contract introduced by #85216 and made user-honest by #86227.

profiles.configure persists a non-empty profile capability selection at tools.enabled_toolsets, and profiles.describe presents that pin as authoritative. The TUI/Desktop gateway did not consume it when constructing an agent. A Bot Chat opened in a code workspace could therefore show one capability set in the editor while receiving the generic coding toolset at runtime.

Root cause

#43316 intentionally made focus-mode coding posture fill only an unpinned default selection. _load_enabled_toolsets() recognized HERMES_TUI_TOOLSETS as an explicit pin, but never checked the equivalent profile-scoped pin in the active HERMES_HOME before asking coding posture for a selection.

That made the editor and runtime disagree, and profile plugin tools disappeared from the model schema without an error.

Fix

The gateway now resolves toolsets in this order:

1. HERMES_TUI_TOOLSETS operator override
2. Active profile tools.enabled_toolsets pin
3. Coding-context posture
4. Existing platform configuration fallback

For a profile pin, plugin discovery runs before the agent snapshots schemas. Enabled MCP servers and client-surface toolsets continue to ride alongside the selected profile capabilities. An absent pin, including an editor-cleared empty list, preserves the existing posture and platform behavior.

No config keys, model tools, plugin-specific behavior, or user-facing commands are added.

Changes made

• tui_gateway/server.py: consume the active profile capability pin before coding posture and document the resolver contract.
• tests/test_tui_gateway_server.py: cover precedence, generic plugin discovery, MCP inclusion, desktop surface inclusion, and a real profile-scoped config.yaml load.
• AGENTS.md: record the capability-resolution precedence so future gateway changes preserve editor/runtime parity.

How to test

1. Save a profile with tools.enabled_toolsets: [memory, web].
2. Start a TUI/Desktop Bot Chat for that profile from a code workspace with agent.coding_context: focus.
3. Confirm the runtime receives memory, web, enabled MCP servers, and its client-surface tools rather than replacing the profile selection with coding.
4. Set HERMES_TUI_TOOLSETS; confirm that operator override still wins.

Verification

• scripts/run_tests.sh tests/test_tui_gateway_server.py -q — 587 passed
• scripts/run_tests.sh tests/test_tui_gateway_server.py -k load_enabled_toolsets -q — 13 passed
• ruff check tui_gateway/server.py tests/test_tui_gateway_server.py — passed
• Gateway import smoke test — passed
• git diff --check upstream/main...HEAD — passed

Documentation

No user guide update is needed because this introduces no new setting or workflow. The existing setting now behaves as documented by the profile editor. The internal precedence invariant is recorded in AGENTS.md.

[TheTom]

CI follow-up: the earlier failure was in tests/gateway/test_goal_verdict_send.py::test_goal_verdict_continue_enqueues_continuation, outside the files and behavior changed by this PR. The test passed in five consecutive local runs. After rebasing onto current main, the complete CI matrix reran successfully with no failures, so the original result appears to have been an unrelated timing flake.