fix(security): 5 security hardening fixes

Covers PRs NousResearch#11, NousResearch#13, NousResearch#14, NousResearch#15: Sprint 15 features, security hardening,
OpenRouter routing fix, project picker UX fixes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…on export, pinned sessions, context meter

Ported from ibelick/webclaw PRs NousResearch#24, #10, NousResearch#14, NousResearch#13:
- Command palette (⌘K): search and switch sessions instantly
- Conversation export: download as Markdown, JSON, or Plain Text
- Pinned sessions: pin/unpin from context menu, shown at top of sidebar
- Context meter: token usage ring in chat header with hover details
- Keyboard shortcuts: ⌘K search, ⌘⇧O new session

New UI primitives: autocomplete, command, input, preview-card
Attachment button/preview components (composer already has built-in support)

…ase in finally block' (NousResearch#13) from fix/delegate-credential-lease-leak into main

- safe_print: strip rich markup tags when rich is unavailable so plain
  fallback output doesn't leak literal '[bold red]...[/bold red]' tags
- profiling.aggregate_profiling_stats: stop reconstructing per-call
  timings by repeating the mean (statistically wrong; gave incorrect
  min/max/median across workers). Combine summary stats directly and
  flag median as approximate via median_time_approximate
- run_agent: hoist 'reset_profiler' import to module level; drop noisy
  'dir(tc)' / 'model_dump()' debug logging spam from the verbose path
- batch_runner: drop unused 'import re'; replace bare 'except:' with
  specific (JSONDecodeError, TypeError, AttributeError) and guard
  isinstance(content, str) before calling .strip()
- tools/simple_terminal_tool: replace bare 'except:' with 'except Exception'
  on the SSH-context cleanup paths

Amp-Thread-ID: https://ampcode.com/threads/T-019dce4d-5fc2-703c-b2e4-b8a87ec42105
Co-authored-by: Amp <amp@ampcode.com>

Per P0-C spike decision (c), formalize aiseo_cli.py sync as a
permanent fork-only asset. ADR-001 captures Context (5 BLOCKING gaps
in upstream), Decision (don't refactor to delegate), Consequences
(re-evaluation triggers + quarterly review), and Status.

Adds 3 protection tests guarding the BLOCKING gaps that justify (c):
- gap NousResearch#3: rolling backup pruning keeps newest 5 by timestamp
- gap NousResearch#7: text-level yaml migration preserves all comments + blanks
- gap NousResearch#13: _migrate_profile_config calls os.fsync on tmp file

CLAUDE.md, NEXT_STEPS.md and seeds README all link back to ADR-001
+ spike doc for traceability and quarterly re-evaluation cadence.

- 5/25·5/26 wvb-daily-brief-kst0700 cron 연속 Gemini HTTP 429
  (paid Tier 1 1M TPM 초과). v2.5 신설 시 명시한 "429 risk 약간
  상승 감수"가 실제 발생.
- config.yaml ms365 preset: "mail,files" → "mail" (5/16 안정 복귀)
- SKILL.md Step 5 임시 OFF 마킹, Output Format OneDrive 줄 교체,
  Verification NousResearch#13 strikethrough
- 재활성화 조건: (1) Gemini Tier 2 upgrade, OR
  (2) SKILL.md trim (21K → 8-10K bytes) 후 토큰 여유 확인

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…(was lost in chain shift)

NousResearch#15

Three remaining findings from the code review.

NousResearch#12 — hermes_cli/superagent.py: _strip_fences only handled a SINGLE
      leading-and-trailing ``` envelope.  Common model failure mode
      is 'Here is the plan you asked for:\\n```yaml\\nfanout: 2\\n
      ...\\n```\\nLet me know.' — the leading prose means
      stripped.startswith('```') is False so the function returned
      the whole text unchanged, then yaml.safe_load choked → exit 2.

      Fix: regex-based extraction with _FENCE_BLOCK_RE that pulls
      the YAML body out of fenced blocks even when there's prose on
      either side.  Falls back to the simple-strip path for fence-
      only output (preserves existing behaviour).

NousResearch#13 — hermes_cli/web_server.py: /ready was BOTH side-effecting AND
      racy.  (a) Called path.parent.mkdir(parents=True, exist_ok=
      True) on every probe — k8s polls every few seconds, so a
      read-only mount surfaced PermissionError every hit and a
      writeable mount got directories repeatedly recreated.  (b)
      The .readiness_probe storage check used a shared filename;
      two concurrent k8s probes (liveness + readiness simultaneous)
      could race, one's unlink raising FileNotFoundError → false
      'not_ready' on a healthy node.

      Fix: (a) audit_log probe just reports parent.exists(); never
      mutates.  (b) storage probe uses a per-PID + per-call unique
      filename and tolerates FileNotFoundError on cleanup.

NousResearch#15 — hermes_cli/superagent.py + hermes_cli/orchestrate.py: parent
      AIAgent was constructed bare with model=... provider=...
      quiet_mode=True only — no api_key, no base_url, no api_mode,
      no credential_pool.  delegate_task then pulled effective_
      api_key=None from the parent, so child subagents failed to
      authenticate whenever credentials lived in config.yaml
      rather than env vars (the production case for serious users).

      Fix: mirror hermes_cli/oneshot.py's resolve_runtime_provider
      pattern in both _build_parent_agent and superagent.py's
      parent construction.  Threads api_key / base_url / provider /
      api_mode / credential_pool from the resolved runtime, exactly
      like oneshot does.

274 tests pass — no regressions.

All 15 code-review findings are now fixed across three commits
(f25ae81 showstoppers, 06e71bc critical correctness, this commit
lower-severity polish).

https://claude.ai/code/session_01PNyEMgrzVHtXnPGwUfotWw