Summary

Fixes #20372.

Adds an opt-in, bounded auto-handoff path for long Hermes sessions that have been compressed repeatedly:

• introduces agent.auto_handoff_on_compression config with enabled, after_compressions, max_auto_handoffs, mode, and handoff_artifact_dir
• writes a compact, redacted Markdown handoff packet with session/repo/todo/compressed-context state
• supports mode: prompt_user to write a packet while preserving ordinary compression semantics
• supports mode: fresh_session to continue from a linked fresh session only after successful DB-backed rotation
• bounds automatic handoffs with max_auto_handoffs
• constrains handoff artifact writes under the active HERMES_HOME
• adds CLI /handoff-packet [note] for manual packet creation without switching sessions

Safety / behavior notes

• Disabled by default.
• prompt_user mode keeps the normal compression end reason and context-engine boundary.
• fresh_session only writes the artifact, increments the handoff count, resets compressor/plugin state, and replaces active context after a child session has been created successfully.
• If fresh-session rotation is unavailable or child creation fails, Hermes downgrades to an ordinary compressed continuation and does not consume the bounded handoff count.

Test plan

• python -m py_compile agent/conversation_compression.py agent/agent_init.py cli.py hermes_cli/commands.py hermes_cli/config.py hermes_cli/web_server.py run_agent.py tests/run_agent/test_auto_handoff_on_compression.py
• python -m pytest -o 'addopts=' tests/run_agent/test_auto_handoff_on_compression.py -q — 10 passed
• python -m pytest -o 'addopts=' tests/run_agent/test_compress_focus_plugin_fallback.py tests/run_agent/test_session_reset_fix.py tests/run_agent/test_compression_feasibility.py tests/run_agent/test_413_compression.py -q — 36 passed
• python -m pytest -o 'addopts=' tests/hermes_cli/test_web_server.py -k 'config or schema' -q — 25 passed, 120 deselected
• git diff --check
• ruff check agent/conversation_compression.py agent/agent_init.py cli.py hermes_cli/commands.py hermes_cli/config.py hermes_cli/web_server.py run_agent.py tests/run_agent/test_auto_handoff_on_compression.py
• staged added-line security scan for hardcoded secrets / shell injection / eval / pickle / SQL-format patterns
• independent fail-closed review of staged diff passed after blocker fix