fix(hermes): forward run-scoped agent credentials

[spiffaz]

Thinking Path

• Paperclip manages agent work through heartbeat runs.
• The hermes_gateway adapter starts those runs through the Hermes /v1/runs API.
• The adapter declared that it did not support Paperclip run-scoped JWTs.
• Paperclip therefore did not mint an agent bearer for Hermes gateway runs.
• The adapter also had no runtime-only transport for a bearer.
• This pull request enables the existing scoped JWT path and sends the value through the companion Hermes runtime environment contract.
• The benefit is authenticated Paperclip API access without placing a bearer in model-visible prompts, logs, or durable result data.

Linked Issues or Issue Description

What happened?

A hermes_gateway heartbeat did not receive the scoped agent bearer that Paperclip can mint for a run. Authenticated agent endpoints returned HTTP 401 from the awakened runtime.

Expected behavior

Paperclip must mint a run-scoped agent bearer for this adapter. Hermes tool subprocesses must receive it as runtime state. The model prompt and adapter logs must not contain the bearer.

Steps to reproduce

1. Configure an agent with the hermes_gateway adapter.
2. Start a heartbeat.
3. Call an authenticated Paperclip agent endpoint from the Hermes run.
4. Observe HTTP 401 because the run has no agent bearer.

Paperclip version or commit

19be4cf9278b70bc151063778a94bf38bfd5c903

Agent adapter(s) involved

Hermes

Additional context

Companion Hermes runtime contract: NousResearch/hermes-agent#81976

What Changed

• Set supportsLocalAgentJwt for hermes_gateway.
• Give the freshly minted ctx.authToken strict precedence as PAPERCLIP_API_KEY.
• Send Paperclip run, agent, company, API, and task context in /v1/runs.runtime_env.
• Preserve PAPERCLIP_RUN_ID for X-Paperclip-Run-Id on mutations.
• Add the scoped bearer to the adapter redactor.
• Add regression tests for capability discovery, runtime transport, and prompt/result non-exposure.

Verification

• vitest run --config packages/adapters/hermes/vitest.config.ts packages/adapters/hermes/src/gateway/server/execute.test.ts packages/adapters/hermes/src/index.test.ts --testTimeout=30000
• Result at commit 6639b79662306e1a0d6e0491b782cfe3bfc9d2f1: 2 files passed, 27 tests passed.
• git diff --check passed.
• The full Paperclip CI suite passed, including typecheck, build, server suites, workspace suites, release checks, and all three end-to-end shards.

Risks

• The change depends on Hermes support for the allowlisted runtime_env contract. The companion PR provides it.
• An older Hermes gateway ignores the extra JSON field, so the run remains unauthenticated until both halves deploy.
• The adapter never writes the bearer to its prompt or metadata. A tool subprocess can read it because authenticated control-plane calls require that access.

Model Used

OpenAI Codex with model gpt-5.6-sol. The run used reasoning, repository tools, code execution, and independent source review.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used with version and capability details
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked the companion PR above
• I have described the issue in-PR with the bug template labels
• I have not referenced internal or instance-local Paperclip issues or links
• My branch name describes the change and contains no internal ticket id
• I have run focused tests locally and they pass
• I have added tests for my changes
• Relevant behavior is documented in source comments and the companion API contract
• I have considered and documented risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[spiffaz]

Closing this in favor of #10625, which already implements the Paperclip half with full CI coverage. The companion Hermes runtime contract is NousResearch/hermes-agent#81976 and now accepts #10625’s bounded environment payload.