fix(hermes): forward run-scoped agent credentials - #11102

Reviewed 6 changed files across categories: ci_cd, lifecycle, malicious_intent. No GitHub Actions workflow files were modified. No package-manager lifecycle hooks, build scripts, or startup code paths were altered. The changes enable a pre-existing run-scoped JWT forwarding path for the hermes_gateway adapter and add the bearer to the adapter's text redactor; they are confined to adapter capability flags, a runtime_env payload field in the Hermes /v1/runs request body, and corresponding regression tests. No evidence of secret exfiltration, obfuscation, encoded payloads, unexpected network calls, dependency confusion, typosquatting, privilege escalation, suspicious credential handling, telemetry leaks, binary additions, dangerous eval/exec patterns, or reviewer-evasion behavior was found.