fix(runtime): wire the local stream stale ceiling the config already promises

[OmarB97]

agent.local_stream_stale_timeout (default 900) and its env twin
HERMES_LOCAL_STREAM_STALE_TIMEOUT were read by no code. A whole-tree grep
found exactly four references: the default in DEFAULT_CONFIG, the docs row in
website/docs/reference/environment-variables.md, and a test whose name
mentions the knob but which asserted float("inf") — i.e. it locked in the
absence of the ceiling.

The reader was dropped by #263 (d8aced717a), which replaced the inline
load_config() + env_float("HERMES_LOCAL_STREAM_STALE_TIMEOUT", ...) block
with resolve_stream_stale_timeout() and never reinstated the ceiling. That
commit touched only agent/, run_agent.py and tests — the config default and
the docs row were left behind, still promising a bound that no longer existed.
So resolve_stream_stale_timeout returned float("inf") for every generic
(non-DFlash) local endpoint: exactly the infinite disable the 900s default was
introduced to replace.

Why it matters

A knob that is defaulted, documented, and inert is worse than no knob. This one
misdirected a root-cause investigation into deep-context turn timeouts on a
local lane, because the operator and the investigator both reasonably believed a
900s ceiling was in force.

The runtime consequence is worse than a stale doc. With the threshold at inf,
_stale_elapsed > _stream_stale_timeout can never be true, so the stale branch
of the streaming poll loop is unreachable for a generic local endpoint. A
crashed or deadlocked local server that keeps the socket alive with SSE pings
parks the session forever: no reconnect, no fallback, no error the user can act
on.

The fix

resolve_stream_stale_timeout now resolves the ceiling instead of returning
inf, highest precedence first:

1. HERMES_LOCAL_STREAM_STALE_TIMEOUT — the documented escape hatch;
2. agent.local_stream_stale_timeout in config.yaml — the canonical setting;
3. 900s.

Non-positive disables the watchdog, so inf stays reachable as a deliberate
choice for an exotically slow local model. A providers.<id>.stale_timeout_seconds
or an explicit HERMES_STREAM_STALE_TIMEOUT still wins outright, and the local
DeepSeek Flash family keeps its own tighter budget — this branch is only reached
when nothing more specific is set.

The resolved ceiling is then widened — never narrowed — by the request's
context-scaled prefill cost, reusing _dflash_prefill_scaled_timeout. That
helper is already the portable half of the DFlash budget: the per-1k prefill
term is arithmetic (a bigger prompt takes proportionally longer on any backend),
while the cold-start allowance stays gated to the one lane it was measured on. A
flat deadline is precisely how the old ladder killed healthy prefills
mid-flight (#278, #334: 240s at ~95k tokens, 240s at ~89k, 180s at ~33k, all on
a server that was still working). Trading "hangs forever" for "kills work that
was fine" would be the worse of the two. The same
HERMES_DFLASH_FIRST_CHUNK_CEILING bound (1800s) caps the result, so a wedged
endpoint is bounded at any prompt size.

Behavior change and the tradeoff

A previously unbounded wedged local server now trips at 900s + 4s/1k of prompt.
That is the intended change, and it is what the config default and the docs have
promised all along.

The risk in the other direction is real and worth stating: this path has no
liveness probe (_local_backend_generation_active stays on the DFlash
first-chunk branch), so a genuinely healthy generic local server that needs
longer than the scaled ceiling gets its connection killed and reconnected, which
costs a re-prefill. The mitigations are the generous 900s base (5× the DFlash
family's), the widen-only context scaling, and a one-line escape hatch
(local_stream_stale_timeout: 0). Extending the liveness probe to this branch
is a reasonable follow-up, but it is a separate behavior change from wiring the
knob.

Tests

tests/agent/test_local_stream_timeout.py::test_generic_local_stream_stale_timeout_still_disables_by_default
asserted float("inf"). That assertion pinned the regression, not the design —
the config default and the docs both describe a finite ceiling, and #263 changed
neither. It is rewritten as
test_generic_local_stream_stale_timeout_is_bounded_but_looser (900s, with the
DFlash family's 180s asserted alongside it on the same endpoint so the contrast
is explicit), and the docstring records why the new number is the right one.

Added TestGenericLocalStreamStaleCeiling, which resolves through the real
config loader and a real AIAgent: default from DEFAULT_CONFIG, config.yaml
value honored, env override, unparseable env falling through to config rather
than being treated as an override, 0/negative disabling, context scaling
(1260s at 90k, 904s at 1k), the 1800s clamp at 400k, and explicit
HERMES_STREAM_STALE_TIMEOUT / providers.<id>.stale_timeout_seconds still
winning.

Added TestGenericLocalStaleWatchdogActuallyFires, which drives the real poll
loop in interruptible_streaming_api_call against a local endpoint that accepts
the request and never sends a chunk. It asserts the kill actually fires at 960s
(first poll past the ceiling on a 60s-per-poll clock) and counts toward the
cross-turn give-up breaker — and that with the ceiling disabled, 1200s of
silence produces no kill at all, which is both the escape hatch and a record of
the pre-fix behavior.

Two test-local mirrors of this resolution still said local means inf. The one
in test_stream_read_timeout_floor.py is exercised (its local case now asserts
900s, which makes the test stronger: it proves the local read-timeout branch
wins outright even when the stale value is finite). The one in
test_reasoning_stale_timeout_floor.py is never called with a local URL, so it
now raises rather than carrying a second, drifting copy of the rule.

Docs

• HERMES_STREAM_RETRIES was documented as defaulting to 3; the code default is
  2, which yields 3 total attempts. Corrected in the EN and zh-Hans env-var
  tables and in the tips corpus (hermes_cli/tips.py).
• Three surfaces still said stale-stream detection is "disabled entirely" for
  local providers: the HERMES_STREAM_STALE_TIMEOUT row, the API-timeouts table
  and prose in user-guide/configuration.md, and the table in
  guides/local-llm-on-mac.md. All corrected to describe the ceiling, the
  context scaling, and the 0 disable.
• Added the knob to cli-config.yaml.example and expanded its DEFAULT_CONFIG
  comment, since config.yaml is the canonical surface and the env var is the
  escape hatch.

Unrelated drift left alone: the zh-Hans env-var table also has stale defaults
for HERMES_API_CALL_STALE_TIMEOUT (300 vs 90) and HERMES_AGENT_TIMEOUT
(900 vs 1800). Those belong to a translation sweep, not to this fix.