Integrate governed worker, worktree, and PR-maintenance upgrades

[mrkillbob]

Summary

This branch integrates the maintained Hermes upgrades from mrkillbob/hermes-agent into the upstream NousResearch/hermes-agent codebase.

The changes cover:

• governed conversation/worktree lifecycle and project-root handling
• Kanban worker dispatch, capacity, watchdog, and terminal cleanup behavior
• exact-head GitHub PR feedback, CI repair, and merge-maintainer flows
• source-bound egress/provenance safeguards and bounded model routing
• config migration/write safety and relay/Slack media behavior
• regression coverage and supporting documentation

The branch was rebased by merging the current upstream main into the upgrade line. No credentials or runtime secrets are included.

Validation

The branch is clean and was reviewed for repository separation before publication. Focused Hermes test execution still requires provisioning the Hermes worktree environment; no claim of acceptance-level test completion is made here.

[mrkillbob]

Updated this integration PR to exact head fa08b24708433a582eb0ce3ba65f9028ab28ff1c (current local main base 5fc308a70719a83cccdbba4c0e39c23f5a8239d5).

This refresh includes the narrow provider-routing repair: when the local egress firewall rejects a payload, fallback now skips remote/unknown providers and selects only a configured local/loopback fallback; the error classifier reason is preserved through the non-retryable path.

Focused evidence on the updated branch: tests/run_agent/test_provider_fallback.py + tests/agent/test_error_classifier.py — 151 passed; git diff --check passed.

The PR remains unmerged. GitHub reports MERGEABLE but BLOCKED because repository checks/review policy have not executed on this exact object.

[mrkillbob]

Closing as superseded by #96905. This branch's two commits not already on hermes/live-worktree-upgrade-refreshed-20260827 (fa08b247 fix: route egress-blocked requests to local fallback, 4e6e883 chore: replay Hermes upgrades onto upstream v0.20.6) are both already present there — verified _fallback_destination_class (the egress-fallback fix's core addition) exists in that branch's current agent/chat_completion_helpers.py. #96905 is also now rebased onto current main and green. Nothing unique remains here to carry forward.