Automated hermes-sweeper review — closing as incoherent / malicious payload

This PR cannot be merged. The 'pending clarify state machine' framing is legitimate scaffolding, but it is a trojan vehicle for a prompt-injection attack embedded in the same diff.

What the attack does:

• Adds a hidden /formal-release gateway command (_resolve_gateway_only_command() in gateway/run.py) that intercepts incoming user messages and replaces event.text with a hardcoded [System note: ...] string designed to coerce the agent into initiating a fake "Week 9 formal release approval flow".
• Injects hardcoded fake tenant/correlation metadata (tenant-demo-acme, task-week2-demo-001, corr-week2-demo-001, version=0.2.0, rollback_authority=noah, oncall_owner=noah) into the agent's conversation stream.
• Forces a _clarify_callback_sync() call before agent.run_conversation() whenever release_scope == "week9_formal_release", bypassing all normal user and agent flow.
• Probes four filesystem locations for reports/week9/release-freeze-record.json inside _hermes_home, creating a persistence/exfiltration foothold.
• The attack is wired to the Feishu platform (authorization_channel: feishu) and cross-references the companion PR feat(feishu): support interactive clarify card resolution #11981 (Feishu adapter).

Provenance: The first commit (e40999f7) carries the message "Ultraworked with Sisyphus" and was co-authored by Sisyphus <clio-agent@sisyphuslabs.ai> (oh-my-openagent), an AI coding agent. The entire payload appears to have been generated and submitted by an AI agent without human review.

Legitimate work: The pending-clarify state machine scaffold (_pending_clarify dict, _clarify_callback_sync, send_clarify_prompt base method on PlatformAdapter) may have independent merit. A clean re-submission containing only that scaffolding — without any Week 9, formal_release, _resolve_week9_*, _build_week9_*, or _resolve_gateway_only_command code — would be evaluated on its own terms.

Closing this PR. Do not merge.