Make Hermes and Codex profiles environment-driven

[uphiago]

Summary

• split Barbarossa deployment settings from Hermes process settings
• configure Hermes provider, model, delegation, and Codex execution profile from environment
• add a Compose wrapper and reduce generated runtime plumbing
• strengthen runtime credential permissions and provider-agnostic log leak checks
• update public documentation and examples

Validation

• 33 infrastructure/configuration tests
• 47 router tests passed, 1 skipped
• Docker Compose configuration validated
• Forge image integration test passed with Codex 0.145 strict config