feat(hermes): promote Hermes Agent to plugin install from repo subdirectory

[spencercharest]

Promotes Hermes Agent from a standalone skills-only install to a native plugin install — without a dedicated mirror repo. Hermes >= v2026.6.19 installs plugins straight from a repo subdirectory:

hermes plugins install officialzeroxyz/zero-plugins/plugins/zero-hermes/hermes --force --enable

Closes ZERO-469.

What's in here

• plugins/zero-hermes/hermes/ — the installable plugin (recovered from feat(hermes): add ZERO-294 Hermes Agent adapter #55, verified against Hermes v2026.7.7.2's plugin API): on_session_start → ensure-runner, pre_llm_call → Zero context, pre_tool_call → blocks zero fetch without --max-pay (Hermes hooks can block, not approve), /zero command, plugin-namespaced skill.
• Vendoring instead of a build step: a subdir install ships only that directory, so the shared ensure-runner.sh and skill are vendored in by scripts/sync-hermes.sh (replaces feat(hermes): add ZERO-294 Hermes Agent adapter #55's dist-assembly build-hermes.sh); .github/workflows/hermes-plugin-sync.yml fails PRs on drift (same pattern as hooks-fragment-sync).
• Matrix: hermes entry gains an install block (minCli 1.14.0); standalone skills fallback stays (plugin skills are explicit-load only in Hermes, so the flat ~/.hermes/skills copy remains the discoverable one).
• Docs: guides/hermes-agent.md (new), Hermes row in guides/agent-install.md, README link.
• Versioning: make minor → 1.11.0; the two new Hermes manifests join MANIFESTS, with the bump recipe extended to handle the YAML manifest.

Why no dedicated repo

A CI-synced mirror would be a permanent maintenance + trust liability (second agent-installed repo, push credentials, silent-staleness failure mode) and its only unique win is native hermes plugins update — which doesn't matter: subdir installs keep no .git, so the --force reinstall is the update path (same end state as a pull of main), to be driven by ZERO-466's sweep. Details in the ticket comment.

Verification (e2e, Hermes v2026.7.7.2 from PyPI, isolated HERMES_HOME)

• hermes plugins install "file://<this branch>#plugins/zero-hermes/hermes" --enable — non-interactive, lands as ~/.hermes/plugins/zero (name from plugin.yaml), enabled in config.yaml, shown as zero / enabled / 1.11.0 in hermes plugins list.
• --force --enable re-run converges (the update path).
• hermes plugins update zero fails with "not installed from git" — expected and documented in the guide.
• GitHub owner/repo/subdir shorthand verified over the network (NousResearch/hermes-agent/plugins/platforms/teams).
• register(ctx) smoke-tested against a stub context: hooks/command/skill all register; guardrail blocks capless zero fetch, passes capped.

Note: the exact officialzeroxyz/... install command only works after this merges (subdir installs clone the default branch), so the doc'd command is unverifiable pre-merge by construction — the file:// + shorthand tests above cover both halves of it.

🤖 Generated with Claude Code