fix(main): wire pair and run subcommands (fixes #21)

[blaspat]

Summary

The hermes-node binary was a stub — it loaded the config, printed one line, and exited 0. The supervisor, dispatcher, pinger, and handlers were all implemented and tested in isolation but had no entry point. This PR wires them up.

Fixes #21.

What changed

Two new subcommands:

• hermes-node pair --server <wss-url> --token <token> [--config <path>] — write a fresh config.toml with the supplied values, mode 0600. Refuses to overwrite an existing config so a re-pair is explicit.
• hermes-node run [--config <path>] — long-lived background service. Connects, serves exec/read/write calls, reconnects on drops with exponential backoff.

Config schema: gains a required [node].token field. config.Load() on Unix verifies the file is mode 0600 — a chmod slip during a manual edit won't silently expose the token. config.Save() is the pair-side counterpart.

Test seam: runRun(ctx, ...) takes a ctx directly so unit tests can drive the supervisor with a deadline-bounded context and assert on connection + shutdown paths without subprocess gymnastics. Production uses signal.NotifyContext.

End-to-end coverage

TestRun_ConnectsToServer stands up an httptest WebSocket server, seeds a config pointing at it, runs hermes-node run in a goroutine, waits for the supervisor's dial to land, and asserts on a clean shutdown when the ctx is cancelled.

Quinn's review

Quinn reviewed the first cut. This branch addresses all 3 warnings (W1-W3) and the suggestions worth shipping (S1, S2, S5 folded into W3, S6):

• W1 — close previous *exec.Session on reconnect (bash PID leak). Setup now closes the previous session before opening a new one via a closure-captured prevSession + prevSessionMu.
• W2 — defaultConfigPath returns an error. The silent "return config.toml" fallback on os.UserHomeDir failure was misleading; run() now surfaces it.
• W3 + S5 — pair stdout message now warns the operator that the default [node].name (the config filename) will silently fail auth per PROTOCOL.md §3.4, and that the default empty [node].allowed_paths will silently reject every call per §3.5.
• S1 — deleted dead driveFakeServer helper.
• S2 — OnError now captures runtime/debug.Stack() so audit log and stderr both carry the trace.
• S6 — added TestSave_CreatesFile0600 unit test (was only integration-tested).

Skipped per Quinn: S3, S4, S7 (not blockers).

Verification

• ✅ go test -race ./... — 6/6 packages, stable across 3 consecutive runs
• ✅ go vet ./... clean
• ✅ go build ./... clean
• ✅ Real-binary smoke: pair writes correct TOML with 0600, 0644 rejected, run dials + backs off + clean SIGTERM, audit log captures reconnect attempts
• ✅ No secrets in diff — test fixtures use placeholder strings

Diff stat

 cmd/hermes-node/main.go        | 378 ++++++++++++++++++++++---
 cmd/hermes-node/main_test.go   | 494 ++++++++++++++++++++++++++++++++++
 internal/config/config.go      |  88 +++++-
 internal/config/config_test.go | 166 +++++++++++
 4 files changed, 1098 insertions(+), 28 deletions(-)