What does this PR do?

Adds config.yaml support for the non-streaming stale-call timeout that currently only exists as the legacy HERMES_API_CALL_STALE_TIMEOUT environment variable. This lets users tune long-running non-streaming turns per provider or per model without relying on .env, while preserving the existing default behavior and local-endpoint safeguards.

Related Issue

Fixes #N/A

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Added providers.<id>.stale_timeout_seconds and providers.<id>.models.<model>.stale_timeout_seconds config resolution in hermes_cli/timeouts.py
• Routed the non-stream watchdog in run_agent.py through a config-aware resolver with legacy HERMES_API_CALL_STALE_TIMEOUT fallback
• Preserved the current implicit-default behavior where non-stream stale detection is auto-disabled for local endpoints unless the timeout is explicitly configured
• Added timeout precedence and local-endpoint coverage in tests/hermes_cli/test_timeouts.py
• Updated cli-config.yaml.example and docs to show how to use the new config keys and how they interact with env vars

How to Test

1. Set providers.openai-codex.stale_timeout_seconds or providers.openai-codex.models.gpt-5.4.stale_timeout_seconds in ~/.hermes/config.yaml
2. Run Hermes against a slow non-streaming turn and confirm the configured stale timeout is used instead of the default 300s
3. Run scripts/run_tests.sh tests/hermes_cli/test_timeouts.py
4. Run scripts/run_tests.sh tests/ -n 4

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Validation completed:

• scripts/run_tests.sh tests/hermes_cli/test_timeouts.py -> 12 passed
• scripts/run_tests.sh tests/ -n 4 -> 29 failed, 13286 passed, 36 skipped in 312.70s

The full-suite failures were outside the files touched by this PR. The failing areas were concentrated in existing DingTalk card tests, Discord/API server defaults, backup/profile wrapper restoration, gateway approval and voice-command tests, Codex CLI model picker tests, web server schema, interrupt/toolset/registry coverage, and a Tirith security test.