feat(cli): maestro-bridge for hermes maestro subcommands

[VertexDevelopments]

Summary

• Adds hermes_cli/maestro_bridge.py that wires hermes maestro plan|approve|status|doctor|... into the CLI argparse tree via three-step resolution: importable → MAESTRO_REPO_ROOT env var → ~/Hermes-Zen-Agent default.
• Adds hermes_cli/maestro.py thin shim that re-exports maestro.cli symbols (so the bridge keeps a stable import surface for downstream tooling).
• Wires registration in hermes_cli/main.py immediately after doctor_parser.set_defaults(func=cmd_doctor) with a try/except that swallows failures at DEBUG so upstream installs without the maestro package keep working unchanged.

Why

Operators running the documented deploy gate

hermes maestro doctor --json && export MAESTRO_DISPATCH_ENABLED=1

could not satisfy the gate without setting MAESTRO_REPO_ROOT by hand. Codex review of PR NousResearch#36 R10 found a HIGH defect: a host where ~/Hermes-Zen-Agent was a stale checkout (e.g. operator now develops in a worktree under ~/Hermes-Zen-Agent/.claude/worktrees/<branch>/) silently resolved the bridge root to that stale tree. hermes maestro --help then listed the old verb set, and hermes maestro doctor --json exited with argparse: invalid choice: 'doctor'.

Two consequences:

• Doctor's R10 install-bridge check matched on file-substring only and let this through.
• Even with MAESTRO_REPO_ROOT set, if maestro.cli was already loaded earlier in the process from a stale path, the env var was ignored — import maestro.cli short-circuited at the first call.

What this fixes

The new bridge:

1. Honors MAESTRO_REPO_ROOT BEFORE any import attempt and purges sys.modules['maestro*'] if a different root was already loaded — so the env var truly takes precedence.
2. Walks up from os.getcwd() looking for a directory that contains the maestro package, so worktree shells resolve to their own Maestro sources rather than a stale parent checkout.
3. Swallows registration failures (logged at DEBUG) so upstream installs without the maestro package are unaffected.

Test plan

• hermes maestro --help lists plan|approve|status|pause|resume|abort|doctor|followup-status (verified on Hermes v0.14.0 / tag v2026.5.16)
• hermes maestro doctor --json runs from a worktree shell and resolves to the worktree's maestro sources (not the parent checkout)
• MAESTRO_REPO_ROOT=/path/to/alt hermes maestro --help resolves to the alt root even when a different root was already loaded earlier in the same Python process
• On a host with no ~/Hermes-Zen-Agent checkout, hermes --help still works (bridge registration silently skipped)
• Existing cmd_doctor behavior unchanged (registration is appended, not inserted)

References

• Operator-side rationale + R10 codex defect closure: Hermes-Zen-Agent/docs/upstream-patches/hermes-cli-maestro-bridge.md
• Original codex review: PR feat: add WhatsApp Web bridge via Baileys NousResearch/hermes-agent#36 R10

🤖 Generated with Claude Code