Summary

Hybrid salvage combining the best parts of three open PRs (#5025, #5026, #21728) that all targeted bug #5022: --clone-all was copying ~2.3 GB of infrastructure alongside ~40 MB of actual profile data.

What this PR does

fix(profiles): exclude infrastructure artifacts when cloning with --clone-all

When the source profile is the default (~/.hermes), shutil.copytree() was copying multi-GB infrastructure: hermes-agent/ (repo checkout + 3 GB venv), .worktrees/, profiles/ (sibling profiles — recursive!), bin/ (installed binaries, ~10 MB), node_modules/ (hundreds of MB).

Fix: Add _CLONE_ALL_DEFAULT_EXCLUDE_ROOT frozenset with these five entries and pass an ignore callback to shutil.copytree(). Exclusions are gated on the source actually being the default profile (is_default_source) so a named-profile source is never affected.

Also exclude at any depth: __pycache__/, *.pyc, *.pyo, *.sock, *.tmp.

Profile data (config.yaml, .env, auth.json, state.db, sessions/, skills/, logs/) is preserved intact — clone-all means "complete snapshot minus infrastructure", which matches what the docs promise.

Mirrors the approach already used by _default_export_ignore() and _DEFAULT_EXPORT_EXCLUDE_ROOT (the export-side exclusion set is broader because it produces a portable archive, not a live clone).

fix(banner): resolve update-check repo from running code, not profile-scoped path

check_for_updates() and _resolve_repo_dir() were preferring $HERMES_HOME/hermes-agent/ over Path(__file__).parent.parent.resolve() when looking for a .git checkout. For profiles created with --clone-all, $HERMES_HOME/hermes-agent/ points to a stale copy with a frozen HEAD, causing persistent "N commits behind" banners that never resolved.

Fix: Flip the resolution order — prefer the running code's location first, fall back to $HERMES_HOME/hermes-agent/ only when the live checkout doesn't have a .git (system-wide pip installs, distro packages). The embedded-rev branch (HERMES_REVISION env var, set by nix builds) is unaffected — it uses git ls-remote against upstream, never reads the local checkout's HEAD.

How this salvage was assembled

What was deliberately excluded (and why)

Author attribution (for contributor audit)

• Commit 1 (fix(profiles): ...): donrhmexe, with Co-authored-by trailers for MustafaKara7 and fahdad
• Commit 2 (fix(banner): ...): fahdad (re-authored with 30740087+fahdad@users.noreply.github.com — their commits on fix(cli): resolve update-check repo from running code + exclude infra artifacts from --clone-all #21728 were anonymized as hermes@agent.local)
• donrhmexe (don.rhm@gmail.com) and MustafaKara7 (karamusti912@gmail.com) are already in AUTHOR_MAP
• fahdad's noreply email resolves automatically via resolve_author() pattern matching — no AUTHOR_MAP edit needed

Test plan

• bash scripts/run_tests.sh tests/hermes_cli/test_profiles.py tests/hermes_cli/test_update_check.py tests/hermes_cli/test_banner.py → 125 passed
• New test test_clone_all_excludes_default_infrastructure asserts: hermes-agent, .worktrees, profiles, bin, node_modules excluded; pycache/.pyc/.pyo/.sock/.tmp excluded at any depth; profile data (skills, config, .env, state.db, sessions, logs) preserved
• Ruff diff vs origin/main: All checks passed

Closes

Closes #5022, #5025, #5026, #21728.

Credit to @donrhmexe, @rahimsais, @MustafaKara7, and @fahdad — this PR combines their independent findings into a unified fix.