Add opt-in "Extended rounds" for Bot Mode group-chat rooms

[RFingAdam]

What changed

Bot Mode's group-chat room loop (apps/desktop/src/plugins/hermes-bots/plugin.js) gets an opt-in "Extended rounds" setting:

• Default (OFF): exact upstream stock behavior — 3 rounds / 10 messages / no wall-clock cap. A fresh install of this fork is byte-identical to NousResearch/hermes-agent until a user explicitly opts in.
• ON: raised ceilings + a new protection — 24 rounds / 120 messages, plus a 30-minute wall-clock cap that stock never had.
• New UI toggle in the Bots pane header (stopwatch icon, next to the activity-toast bell).
• Both the toggle and an optional fine-tune override ({ maxRounds, maxMessages, wallClockMinutes }, hard-clamped, malformed/out-of-range input rejected per-field) persist via plugin storage.

Why the redesign (this supersedes the first commit on this branch)

The first commit on this branch just raised the shipped defaults globally. Adam's direction was better: keep Nous's own behavior as the untouched default, and make "run longer" an explicit, protected opt-in — so this fork never silently diverges from upstream for anyone who doesn't ask for it, and the extended path gets its own independent safety net rather than just bigger numbers.

Safety

• Flipping extended mode off always restores exact stock constants — no override can leak through.
• The wall-clock cap is new and independent of the existing "everyone passed this round" settle exit, which is conversation-shaped (only fires when literally every member passes/times out). Extended mode's much higher round ceiling widens the exposure window if a member ever got stuck producing real-looking, non-settling text every turn — the wall-clock deadline bounds worst-case cost/duration regardless of whether that heuristic ever fires.
• Override values are clamped to hard ranges (rounds 1-100, messages 1-500, wall-clock 1s-2h) and rejected (not silently clamped to a boundary) when out of range or malformed.

Testing

• Rewrote the fork's regression tests for the new design: default-is-stock, toggle raises/restores correctly, override clamps per-field in both directions, an end-to-end test that a tuned-down extended cap actually stops the loop, an end-to-end test that the wall-clock deadline ends a non-settling drive early via real setTimeout-based turn latency, and a test proving stock mode ignores a staged extended-mode override entirely.
• Fixed the test harness's prompt.submit mock to await turnScript (previously sync-only, silently no-op'd on an async turnScript — needed for the real-latency wall-clock test).
• Full hermes-bots plugin suite: 244/244 passing (node --test src/plugins/hermes-bots/tests/*.test.mjs).
• Secret scan clean on both changed files.

Scope note

Targets our fork's own working branch (feat/kanban-completion-guards-and-oauth-sanitize, which carries pre-existing local kanban/OAuth patches), not NousResearch/hermes-agent upstream main — this is a fork-local feature we're managing ourselves, not (yet) proposed upstream.

Not in scope here

The gateway-side per-platform require_mention mention-gate (Discord/Telegram/etc adapters) that production group chats actually run on is a different mechanism (per-message gating, not a round-count ceiling) and isn't touched by this PR.

[RFingAdam]

Post-merge verification — workstation (swamp) desktop rollout

Repointed this workstation's checkout (/home/swamp/.hermes/hermes-agent) to the fork and rebuilt Desktop (hermes desktop --force-build); install stamp 791fc6673d09. Drove the packaged renderer over a loopback CDP port and confirmed the feature end-to-end:

• Toggle works and persists. Stopwatch in the Bots roster header; aria-label flips Enable ⇄ Disable extended group-chat rounds; state stored at hermes.plugin.hermes-bots.group-chat-extended-mode and survives restart. Flipping it back off restores exact stock behavior.
• Ceilings confirmed live. Stock 3 rounds / 10 messages / no wall-clock; extended 24 / 120 / 30 min. The settle-on-all-pass exit still fires under extended.
• Override lever works: group-chat-extended-override ({maxRounds, maxMessages, wallClockMinutes|wallClockMs}) raises ceilings with no rebuild.

One UX/docs note worth surfacing: in rooms with 5 bots the message cap (10), not the round cap (3), is the effective wall — it bites after 2 rounds. A user reads "3 max" in the tooltip but sees the drive stop at 2 rounds / 10 messages. Might be worth wording the stock tooltip around messages, or scaling the message cap with roster size. Extended's 120 makes this a non-issue there.

Rollout follow-ups (not this PR):

• 3080 PC (10.27.27.10) still builds from Nous main — no stopwatch yet; needs the same repoint.
• The fork branch is ~755 commits behind upstream/main, so the desktop "behind main" badge now counts against the fork's main and reads +1032. Expected given how the count works (HEAD..origin/main); merging upstream/main into the feature branch clears it.