Bug

When API keys are stored in ~/.hermes/.env (not in shell environment), credential_pool._seed_from_env() only checks os.environ and misses them. Additionally, hermes_cli/auth.py:_resolve_api_key_provider_secret() does not fall back to the credential pool when no env var is found.

Reproduction

1. Remove all API key env vars from shell (e.g. unset OPENAI_API_KEY)
2. Store key in ~/.hermes/.env: OPENAI_API_KEY=sk-...
3. Start hermes with a provider that requires the key
4. Observe: "No API key found" despite .env having the key

Expected Behavior

1. _seed_from_env() should also check ~/.hermes/.env via hermes_cli.config.get_env_value()
2. _resolve_api_key_provider_secret() should fall back to credential_pool.load_pool() when env vars are empty

Environment

• hermes-agent latest main
• Any provider using API key auth
• Keys stored in ~/.hermes/.env instead of shell env vars