feat(agent-init): add Hermes platform support (sable-gyw)

[Rome-1]

Summary

Adds Hermes to the supported-platforms list. MCP-only v0 — mirrors how Gemini and Continue.dev were initially shipped. Replaces the placeholder rf-01b reference in shared-docs/PLATFORM_PARITY_AUDIT.md:248 (that bead never existed; sable-gyw is the real tracking bead).

rafter agent init --with-hermes

Merges Rafter into ~/.hermes/config.yaml under mcp_servers.rafter (snake_case — distinct from Cursor/Windsurf's mcpServers camelCase). Existing servers and other top-level YAML keys are preserved.

Scope

Implemented (v0):

• installHermesMcp() (Node) + _install_hermes_mcp() (Python) using js-yaml / PyYAML
• --with-hermes flag wired end-to-end on both runtimes: option declaration → detection (~/.hermes) → want resolution → warning for "requested but not detected" → detected[] entry → install call site → agent.environments.hermes.enabled config flag → dry-run plan entry → final-message platform hint
• recipes/hermes.md — automatic + manual setup, documents the four MCP tools (scan_secrets, evaluate_command, read_audit_log, get_config), warns about YAML round-trip comment loss for hand-curated configs
• README updates: badge row, supported-platforms description, install-list table, MCP-based platforms paragraph

Deferred (follow-on beads to be filed once v0 lands):

• agent verify / agent list / agent status Hermes detection
• Hook support (no documented Hermes hook surface yet — same posture we took for Gemini and Continue.dev before their hook surfaces stabilized)
• --local scope (Hermes lacks a project-local config story)

Tests

12 Hermes-specific assertions, all passing locally:

Node (node/tests/agent-init-hermes.test.ts, subprocess-driven against built dist/):

• Creates config.yaml from scratch with mcp_servers.rafter populated
• Preserves existing mcp_servers entries and other top-level YAML keys
• Idempotent on a second run
• Recovers from unreadable / malformed YAML
• Coerces an array-shaped mcp_servers (wrong shape) into a dict
• Warns when --with-hermes is requested but ~/.hermes doesn't exist
• Lists Hermes in the dry-run plan when detected

Python (python/tests/test_agent_init.py::TestInstallHermesMcp, direct installer):

• Same five core behaviors (fresh-config, preserve, idempotent, unreadable-YAML, array-shape-coerce)

Broader regressions:

• Python test_agent_init.py full suite: 82 passed
• Node agent-commands.test.ts full suite: 79 passed

Security review

rafter agent reviewed the diff — verdict GO, no findings. YAML safety verified (js-yaml v4+ DEFAULT_SCHEMA on Node, yaml.safe_load on Python). No new shell, no subprocesses, no network calls. Paths are constructed from os.homedir() / process.cwd() plus hardcoded literals — no user-controlled input reaches a file path.

Tracking

• Bead: sable-gyw (claimed by me for this PR)
• Discovered from: customer question about manus.im / n8n integration that sparked a "what's first-class vs primitive" conversation; Hermes was already cited as future work in the platform-parity audit but with a non-existent tracking bead.

🤖 Generated with Claude Code