fix(hermes): port two post-handoff fixes and floor the deps at 0.10.1

[nicoloboschi]

Closes #4640.

The two fixes teknium flagged

Both landed on hermes-agent's bundled plugins/memory/hindsight after the 2026-09-17 handoff and never reached this tree. Users moved onto our copy by the catalog migration would have regressed on them.

1. Bounded append-mode turn buffer (hermes-agent 6e1de4850e6, their #62950)

sync_turn now clears _session_turns after an append retain instead of advancing the watermark to its length. The retain job snapshots its own content and append retains only ever read the un-retained tail, so keeping every turn pinned the whole session in memory on long-running gateway sessions. Overwrite mode is untouched — it resends the full session each retain and must keep every turn.

This also removes a duplicate write I hit while testing: on_session_switch flushes the whole buffer under the old document id, so after an append retain it re-shipped turns that were already stored. test_session_switch_starts_a_new_document was pinning that second retain (["session-1", "session-1", "session-2"]); it now expects one retain per session.

2. Gated root warning (hermes-agent cd3de040ab9)

initialize() records warning_callback / platform, and _start_embedded_daemon routes the "cannot run as root" notice through the host's sink, falling back to gateway.warning_notifications.render_notification, instead of an unconditional stderr print. That's what lets users opt out of user-channel warnings on messaging platforms.

Nit: dropped the hooks: key from plugin.yaml — Hermes reads provides_hooks, and the bundled copy dropped the declaration in 72ee40fa680 because memory providers get lifecycle calls through the provider interface, not registered hooks.

Dependency floor → 0.10.1

hindsight-embed 0.10.0 (on PyPI 2026-09-14 → 2026-09-21) shipped a probe that ran asyncio.run on the caller's thread, clearing its event loop, so the next client call hit an aiohttp session bound to a dead loop and local_embedded failed outright with Timeout context manager should be used inside a task. Fixed in 0.10.1.

I confirmed this against the published wheels, not just the source:

version	released	probe_get
0.9.2	Aug 25	fine (predates the aiohttp move)
0.10.0	Sep 14	buggy — has the get_running_loop() / asyncio.run(probe()) fast path
0.10.1	Sep 21	fixed

Anyone who installed in that window is pinned to the broken release, because >=0.6.1,<1 is satisfied by 0.10.0 and nothing moves them. Floors in pyproject.toml and plugin.yaml now sit at >=0.10.1, and _MIN_CLIENT_VERSION moves with them so _maybe_upgrade_client() pulls the client forward on session start rather than waiting for a hermes update.

Tests

Two regression tests, each verified to fail on the pre-fix code (I reverted each fix and watched the test go red):

• test_append_mode_drops_retained_turns_from_the_buffer — buffer empty, watermark 0, each retain carries only its own delta
• test_overwrite_mode_keeps_every_turn — the other half of the branch, so nobody "simplifies" the clear into both paths
• test_root_warning_goes_through_the_hosts_warning_callback — callback receives it, stderr does not

24 pass, lint clean.

After merge

This needs a SHA bump in plugin-catalog/hindsight.yaml (sha + version together) for any of it to reach users — the catalog currently pins dc75038.