llmAntidote v3.2.2

Fixes a taint-bypass egress channel found in review.

Bug

text_to_speech was classified as a local write (outbound=False), and its required text argument is a "content key". Two compounding mis-scopings:

1. A tainted session did not block speaking a secret, while web_search/browser_exec were blocked.
2. The payload was exempted from scanning and the oversized-arguments gate as a content key.

Hermes sends TTS text to a provider; the built-in providers (edge, elevenlabs, openai, minimax, xai, mistral, gemini) are remote. Only a user-configured type: command provider is local.

Fix

• Reclassified text_to_speech as an outbound-network capability, so it is scanned in full, size-gated, and blocked by session taint like other outbound tools. Bumped the capability classifier version to 3.
• Limited the content-key exemption to the file-write tools (write_file/patch/apply_patch) instead of every local-write capability, so other local-write payloads are no longer silently unscanned and uncapped.

Verification

• pytest: 188 passed; coverage 81.8% (branch).
• ruff check . and mypy: clean.
• pip-audit -r requirements.txt: no known vulnerabilities.
• CI matrix (3.11/3.12/3.13), manifest validation, and the real-Hermes e2e job (standalone + enforced, including a tainted-TTS case) all green.

Compatibility

• Drop-in upgrade from 3.2.1. Python 3.11+; Hermes Agent 0.21.x.
• Note: TTS is now conservatively treated as egress even with a local command provider.

Full details in CHANGELOG.md.