fix(doctor): use get_env_value for API keys and base URLs instead of os.getenv

Problem

hermes_cli/doctor.py uses os.getenv() to read API keys and base URL env vars. os.getenv() only reads from os.environ, so values stored in ~/.hermes/.env (the standard location for API keys) are silently missed.

This causes:

• API key blindspot: hermes doctor reports keys as "not configured" when they exist only in ~/.hermes/.env
• Base URL fallback: providers with a custom BASE_URL in .env (like DASHSCOPE_BASE_URL) fall back to wrong registry defaults, causing false "invalid key" reports

Same pattern as #18757 (fixed in auth.py) — the os.getenv() vs get_env_value() inconsistency.

Fix

Replace os.getenv() with get_env_value() (with os.getenv() fallback) at 3 call sites:

1. Line 1206 (_probe_openrouter): os.getenv("OPENROUTER_API_KEY") → get_env_value("OPENROUTER_API_KEY") or os.getenv(...)
2. Line 1339 (_probe_apikey_provider key loop): os.getenv(ev, "") → get_env_value(ev) or os.getenv(ev, "")
3. Line 1354 (_probe_apikey_provider base URL): os.getenv(base_env, "") → get_env_value(base_env) or os.getenv(base_env, "")

Also imports get_env_value at the top of the file alongside existing hermes_cli.config imports.

Related

• [Bug]: resolve_api_key_provider_credentials() uses os.getenv for base_url_env_var — misses ~/.hermes/.env values #18757 — same fix applied to auth.py and runtime_provider.py
• fix(doctor): use get_env_value for API keys and base URLs instead of os.getenv #18989 — the earlier PR for this same fix (now 1021 commits behind main and shows DIRTY merge state)

Supersedes #18989 (rebased onto current origin/main, avoiding the stale DIRTY branch).