…des (NousResearch#16678)

When a gateway session uses /model to switch to a different provider,
the gateway stored the new provider's model/api_key/base_url/api_mode
in `_session_model_overrides[session_key]` but dropped the credential
pool returned by `resolve_runtime_provider`.  On the next turn,
`_apply_session_model_override` updated runtime_kwargs for everything
*except* `credential_pool`, so the original provider's pool stayed live.

Result: a 429 on the new provider rotated within the *old* provider's
pool (whose credentials don't apply to the new endpoint), or — when
the old runtime had no pool — skipped rotation entirely and fell
through to the configured fallback model instead of rotating to the
next credential on the new provider.

Fix:

- Add `credential_pool` to `ModelSwitchResult` and capture it in
  `switch_model()` from the runtime resolution on both the explicit-
  provider path and the same-provider re-resolve path.
- Store `credential_pool` on `_session_model_overrides[session_key]`
  in both /model handler paths (regular switch + picker callback).
- `_apply_session_model_override` now also propagates `credential_pool`,
  with one specific deviation: an explicit `None` overrides the prior
  pool instead of being skipped, because a switched-to provider may
  legitimately have no pool and leaving the old one in place would
  rotate against the wrong provider's credentials.

Test plan:

- `tests/hermes_cli/test_model_switch_credential_pool.py` — pins that
  `ModelSwitchResult.credential_pool` carries the resolved pool on
  explicit-provider switches, same-provider re-resolves, and the
  no-pool case.
- `tests/gateway/test_session_model_override_routing.py` — three new
  cases verify `_apply_session_model_override` propagates the override
  pool, replaces an existing pool with `None` when explicitly cleared,
  and keeps the existing runtime pool when the override predates this
  field (legacy shape).
- Regression-guarded: temporarily reverted the production change and
  confirmed all 5 new assertions fail with the precise expected
  AttributeError / pool-identity mismatch on clean origin/main, then
  restored.
- Adjacent: full `tests/hermes_cli/test_model_switch_*.py`,
  `tests/run_agent/test_switch_model_*.py`, and gateway session/model
  tests pass (101 + 18).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Address Copilot review on PR NousResearch#16701:

1. **`ModelSwitchResult.credential_pool` typed as `Optional[Any]`** —
   the runtime provider resolver returns a concrete `CredentialPool`
   instance, so the dataclass field is now typed as
   `Optional["CredentialPool"]` via a `TYPE_CHECKING`-guarded import
   from `agent.credential_pool`.  Keeps the runtime import graph
   asymmetric (agent.* depends on hermes_cli.*, not the reverse) while
   surfacing the contract to static analysis.

2. **`_session_model_overrides: Dict[str, Dict[str, str]]`** —
   the dict now also stores a live `CredentialPool` under the
   `credential_pool` key, which is not a `str`.  Widen the value type
   to `Dict[str, Any]` (both the class-level annotation and the
   instance-level assignment in `__init__`) and update the comment to
   document that `credential_pool` rides alongside the str fields.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…gent.switch_model

Widens the credential_pool fix to cover the two CLI /model paths and the
AIAgent in-place swap, completing the propagation chain that began with the
gateway-only fix in d768cf0.

Three sites still dropped the resolved pool when /model was invoked outside
the gateway:

  * `cli.py::_apply_model_switch_result` — model picker → switch_model
  * `cli.py::_handle_model_switch` — `/model <name>` command → switch_model
  * `run_agent.py::AIAgent.switch_model` — accepted no `credential_pool`
    kwarg, so even when callers had the pool there was no way to apply it
    to the live agent's `_credential_pool`

After this change the full chain is covered: ModelSwitchResult carries the
pool out of the resolver, both CLI call sites mirror it onto
``self._credential_pool`` and forward it into ``agent.switch_model()``,
which applies it under the same ``if credential_pool is not None`` guard
the gateway uses.  A switch from one pooled provider to another now keeps
429/402 rotation working on the new provider; a switch to a single-key
provider preserves the existing pool rather than silently clearing it.

Test plan
- new `tests/run_agent/test_switch_model_credential_pool.py` (3 cases):
  swap pool, omit kwarg keeps existing, explicit None preserves existing
- existing `tests/hermes_cli/test_model_switch_credential_pool.py` (3) and
  `tests/gateway/test_session_model_override_routing.py` (5) pass against
  the wider propagation
- regression guard: removing the `if credential_pool is not None` block in
  run_agent.switch_model fails the swap-pool test; dropping the kwarg from
  the agent signature fails the call-site at TypeError

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>