feat: agent adopt for Hermes and OpenClaw installs

[zloeber]

Summary

• Add secretzero agent list, agent adopt, and agent backup (alias) to bootstrap SecretZero environments from local Hermes or OpenClaw installs without emitting secret values into CLI/JSON output.
• Introduce a pluggable integrations layer (src/secretzero/integrations/) with catalog-driven dotenv scanning, idempotent manifest merge, optional lockfile preseed, and safe template generation.
• Update agent onboarding docs/skills (new secretzero-agent-adopt skill, README cold-start agent-entrypoint metadata, user guide, ROUTER/pattern).

Test plan

• pytest tests/test_agent_adopt.py
• pytest tests/test_download_secretzero_skills_script.py
• Full test suite (task test) — 1126 passed
• ./scripts/agent.pre-commit.sh --mode fast --quiet
• Manual: secretzero agent list --format json
• Manual: secretzero agent adopt --dry-run --format json
• Manual: secretzero agent adopt --target hermes --output-dir ./agents/hermes --template --preseed-lockfile
• Manual: secretzero validate -f agents/hermes/Secretfile.yml and secretzero agent sync --json -f agents/hermes/Secretfile.yml

Notes

• agents/hermes/ is a GitOps example captured from a local adopt run (hash-only lockfile, no plaintext secrets). Paths currently reference a developer home directory; consider generalizing agent_home before merge if reviewers prefer a portable example.
• agent backup is intentionally not secretzero backup create (encrypted DR export).