fix(messaging): allow only pull and acknowledge on the Hermes Pub/Sub route

The Google Chat preset for Hermes allowed POST to every Pub/Sub v1 path, and
the comment justified that width with a claim about glob matching that does
not hold. The L7 matcher is glob.match(pattern, ["/"], path), so `/` is the
only delimiter and `*` already spans the `:verb` suffix inside a segment.

The adapter issues exactly two Pub/Sub requests, `:pull` and `:acknowledge`,
so restrict the route to those. The gateway injects a bearer carrying the
pubsub scope here, and the previous rule also permitted publish and
subscription administration from inside the sandbox. Presets cannot template
the configured subscription, so the rules match the subscription path shape.

Drop the stale `:modifyAckDeadline` mention; the adapter never issues it.

Author: hunglp6d

src/lib/messaging/channels/googlechat/policy/hermes.yaml

@@ -10,7 +10,7 @@ network_policies:
     name: googlechat_hermes
     endpoints:
       # Inbound: pull Chat events from the Pub/Sub subscription over the REST
-      # unary API (:pull, :acknowledge, :modifyAckDeadline). Not gRPC
+      # unary API (:pull, :acknowledge). Not gRPC
       # StreamingPull — REST keeps the egress L7-inspectable so the
       # gateway-minted token is injected by the proxy (keyless). The
       # subscription lives under /v1/projects/{project}/subscriptions/{sub}.
@@ -19,11 +19,14 @@ network_policies:
         protocol: rest
         enforcement: enforce
         rules:
-          # Pub/Sub REST pull uses Google custom-method verbs with a colon suffix:
-          # `/v1/projects/{p}/subscriptions/{s}:pull` / `:acknowledge` /
-          # `:modifyAckDeadline`. Match the whole /v1 tree so the `:verb` suffix
-          # is covered (a `/v1/projects/**` glob can miss the trailing `:pull`).
-          - allow: { method: POST, path: "/v1/**" }
+          # Pub/Sub REST pull uses Google custom-method verbs with a colon
+          # suffix: `/v1/projects/{p}/subscriptions/{s}:pull`. The L7 matcher is
+          # `glob.match(pattern, ["/"], path)`, so `/` is the only delimiter and
+          # `*` spans the `:verb` suffix within a segment. Allow just the two
+          # operations the adapter issues; a broader `/v1/**` would also permit
+          # publish and subscription administration on the injected bearer.
+          - allow: { method: POST, path: "/v1/projects/*/subscriptions/*:pull" }
+          - allow: { method: POST, path: "/v1/projects/*/subscriptions/*:acknowledge" }
       # Outbound reply: send/update/delete messages in Chat spaces. Same rule
       # shape as the OpenClaw preset — writes scoped to the Chat `spaces` tree,
       # reads across the Chat REST v1 tree.