Add harness for Hermes Agent

[eugeneng04]

Summary

This PR adds support for the Hermes CLI agent as a first-class agent harness in devops-bench.

Hermes is an autonomous DevOps agent CLI built by Nous Research. This integration enables running
the benchmark against Hermes using standard models and providers (including GCP Vertex AI and Google
GenAI), extracting detailed execution trajectories, and running end-to-end evaluations.

Key Additions & Refactorings

1. Hermes Agent Harness (devops_bench/agents/cli/hermes/)

   • Harness Execution: Implemented the HermesAgent class, which stages agent configuration,
     .env file context, and SOUL.md in a per-run isolated temp directory ($HERMES_HOME) to prevent
     state leakage.
   • Process Wrapping: Drives the agent using the centralized devops_run core process wrapper
     with custom environment overlays and timeout configuration.
   • Provider Resolution: Integrated the harness with the centralized model contract
     resolve_provider to map the google-vertex provider onto the --provider vertex backend.
   • Trajectory Parser: Extracts the execution trajectory and tool details from the agent's
     SQLite state.db database. Trajectory retrieval is optimized since sessions are run-scoped inside a
     temporary directory.

2. Integration & Docs

   • Added registration to _BUILTIN_AGENT_MODULES in devops_bench/evalharness/default.py to
     support lazy module loading.
   • Updated docs/components/agents.md to add hermes in the supported harnesses table, detailing
     its execution model, SQLite database storage pattern, and structural capabilities (MCP, skills, rules).

3. Test Coverage

   • Added unit tests for agent configuration staging, binary resolution, and command-line execution
     (test_hermes_agent.py).
   • Added comprehensive trajectory extraction tests (test_hermes_parsing.py) evaluating SQLite
     schema queries, tool arguments parsing, missing attributes, and session queries.

4. Environment Isolation Fixes

   • Claude Client Test Protection: Cleared os.environ in test_models_claude.py tests to
     prevent parent environment credentials (e.g. AGENT_API_KEY) from bleeding into mock tests and
     forcing real Anthropic client initialization.
   • OpenClaw Harness Test Protection: Updated test_agents_cli_openclaw.py to prune API keys
     from the subprocess test env to verify keyless/ADC authentication paths correctly.

Testing Done

• Ran the full test suite locally with uv run pytest (all 895 tests passed).
• Verified GKE cluster connectivity to hermes-test-cluster in GCP project ngeugene-gke-dev.

[eugeneng04]

Added token usage reporting (eccfbd2): the harness previously set no tokens at all. It now reads the latest session's counts from state.db's sessions table (input_tokens / output_tokens / reasoning_tokens / cache_read_tokens / cache_write_tokens) into the canonical six-bucket shape — {input, cached, cache_write, reasoning, output, total}, None for unreported buckets.

Notes for review:

• Hermes runs Anthropic prompt caching with explicit cache_control breakpoints (always-on), so cached — and cache_write, which few harnesses can report — should carry real volume.
• Columns are probed via PRAGMA table_info, so older Hermes schemas (and missing/corrupt DBs) degrade to all-None, never a fabricated 0. The timeout path reports whatever was flushed before the kill.
• One assumption to verify against a real state.db: that Hermes's input_tokens excludes cache reads (the Anthropic convention, since the columns mirror Anthropic usage fields). If it turns out to be the full prompt, the mapping needs an input − cache_read adjustment.
• Aligns with the canonical token schema in feat: canonical token buckets across harnesses and the result row #212 (this branch defines the bucket tuple locally; it can import the shared helper once feat: canonical token buckets across harnesses and the result row #212 lands).