feat(security): add sanitized remote worker boundary

[mrkillbob]

What does this PR do?

Adds a fail-closed secure-worker workflow for repository-capable local and remote models. It creates manifest-bound sanitized workspaces, requires an offline digest-pinned Docker task container, and exposes GitHub operations only through a typed broker bound to one private staging repository.

This preserves useful coding, branching, issue, pull-request, and review workflows without giving a remote model the production checkout, ambient host credentials, arbitrary GitHub targets, or general task-container egress.

Related Issue

No linked issue.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Add hermes secure-worker commands for pack creation, boundary audit, profile rendering, privacy attestation, diff verification, and safe destruction.
• Add a staging-only GitHub MCP broker with fixed owner/repository binding and typed branch, file, issue, pull-request, and review operations.
• Add Docker host-data isolation that suppresses automatic credential, skill, cache, and egress-proxy mounts and partitions container reuse by isolation mode.
• Add local-safe and remote-sanitized profile examples, a minimal trusted worker image, policy and image-lock examples, and operator documentation.
• Add adversarial tests for path escape, dirty/untracked input, secrets, binary data, unsafe mounts, networking, cloud fallbacks, credential inheritance, broker route escape, redirects, and repository permission checks.

How to Test

1. Run pytest -q -p no:cacheprovider tests/hermes_cli/test_secure_worker.py tests/hermes_cli/test_secure_worker_cli.py tests/hermes_cli/test_secure_github_broker.py tests/tools/test_docker_environment.py tests/tools/test_docker_network_config.py tests/tools/test_docker_cgroup_limits.py tests/tools/test_docker_session_isolation.py tests/tools/test_credential_files.py tests/tools/test_mcp_tool.py tests/tools/test_terminal_config_env_sync.py tests/hermes_cli/test_startup_fast_guards.py.
2. Build examples/secure-worker/Dockerfile, record its immutable image ID, and render a profile with hermes secure-worker profile-render.
3. Run hermes secure-worker audit with the image lock, sanitized pack, and short-lived privacy attestation; verify it denies Docker/network/credential/fallback mutations.

Focused verification: 317 passed. A live Colima smoke also confirmed non-root execution, absent ambient credentials and host auth paths, blocked task-container networking, and usable Git/Python tooling.

The repository-wide suite was not claimed green: an earlier full run reached an unrelated order-dependent failure that passes alone.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 26.6.2 on Apple Silicon, Docker via Colima

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Not applicable; this is a CLI and security-boundary change.

[mrkillbob]

Superseded by #93182. The original branch was based on a divergent local main and unintentionally included unrelated commits; the replacement is rebuilt from current upstream main and contains only the secure-worker change.