fix: close finalized per-agent LCM clones

[bennybuoy]

Summary

• register the supported on_session_finalize plugin hook on current main
• resolve the exact per-agent LCM clone by durable session ID
• shut down only that finalized clone, leaving other active clones and the plugin prototype untouched
• preserve interactive CLI /new, which reuses its agent and context engine

Why

Hermes deep-copies the registered context-engine prototype for each AIAgent. In long-lived Desktop and gateway processes, retiring an agent does not guarantee that the clone's SQLite-backed LCM helpers are closed. Finalized sessions can therefore leave Store, DAG, and lifecycle descriptors open.

The plugin already owns an exact weak session-to-engine registry and an idempotent shutdown() boundary. This change connects those existing pieces through Hermes' supported hard session-boundary hook; it does not patch Hermes core or sweep unrelated engines.

This refreshes #470 on current main. It is complementary to #501: shared clone storage reduces per-clone SQLite ownership, while this hook closes the finalized clone's own lease/resources at the host lifecycle boundary.

Validation

• Focused lifecycle and packaging validation: HERMES_HOME=<temp> pytest tests/test_plugin_lifecycle_cleanup.py tests/test_packaging_install.py -q -> 40 passed
• Compatibility validation with fix: share SQLite storage across LCM engine clones #501 applied: lifecycle cleanup + shared-storage class + packaging -> 53 passed
• Default validation:
  • pytest tests/test_lcm_core.py tests/test_lcm_engine.py tests/test_packaging_install.py tests/test_plugin_lifecycle_cleanup.py -q -> 1100 passed
  • pytest -q
  • scripts/validate_release.sh --full --keep-going --output /tmp/hermes-lcm-release-validation-finalize-clones-v2
  • git diff --check origin/main...HEAD && git diff --check && git diff --cached --check
• Ruff 0.15.13 on changed Python files
• Python compilation on changed Python files

Notes

• Scope is plugin-owned LCM clone cleanup only; it does not claim to close Hermes-owned state.db connections.
• The branch is intentionally opened as a draft while broader validation and review complete.

Refs #463
Replaces #470

[bennybuoy]

Closing after independent lifecycle review found a release blocker: Hermes currently invokes on_session_finalize before AIAgent.shutdown_memory_provider() calls the context engine’s required on_session_end() flush. This draft therefore closes SQLite helpers too early, can drop the final assistant tail, and can leave lifecycle finalization incomplete. The session-ID registry is also last-bound rather than an exact retired-agent identity, so the hook cannot safely choose a clone when bindings overlap. This needs a different host/plugin handshake rather than patching around the ordering.