Fixes #36144.

Summary

• keep host tool subprocesses on the user's real HOME so git, ssh, gh, npm, az, and similar CLIs can find existing credentials/config
• repair HOME back to the OS account home when the parent process already points at a Hermes profile home, with HERMES_REAL_HOME as an explicit override
• add Windows fallback repair through USERPROFILE and HOMEDRIVE/HOMEPATH when Unix pwd is unavailable
• preserve Docker/Podman behavior by continuing to use {HERMES_HOME}/home inside containers for persistent tool state
• update local env, code execution, ACP child env, profile docs, CLI tips, and regression coverage
• isolate strict API validation tests from live provider metadata lookups so CI does not depend on api.fireworks.ai

Verification

• .venv\\Scripts\\python.exe -m pytest tests/test_subprocess_home_isolation.py::TestGetSubprocessHome::test_profile_home_env_is_corrected_to_userprofile_when_pwd_unavailable -q --timeout-method=thread -> 1 passed after failing before the fix
• .venv\\Scripts\\python.exe -m pytest tests/test_subprocess_home_isolation.py::TestGetSubprocessHome tests/test_subprocess_home_isolation.py::TestSanitizeSubprocessEnvHomeInjection tests/test_subprocess_home_isolation.py::TestPythonProcessUnchanged -q --timeout-method=thread -> 14 passed
• .venv\\Scripts\\python.exe -m pytest tests/test_subprocess_home_isolation.py tests/agent/test_copilot_acp_client.py tests/tools/test_env_passthrough.py tests/tools/test_code_execution.py tests/tools/test_code_execution_modes.py tests/cron/test_cron_profile.py -q --timeout-method=thread -> 124 passed, 43 skipped
• .venv\\Scripts\\python.exe -m pytest tests/run_agent/test_strict_api_validation.py -q --timeout-method=thread -> 4 passed
• .venv\\Scripts\\python.exe -m ruff check hermes_constants.py hermes_cli/profiles.py hermes_cli/tips.py tools/environments/local.py tools/code_execution_tool.py agent/copilot_acp_client.py cron/scheduler.py tests/test_subprocess_home_isolation.py tests/agent/test_copilot_acp_client.py tests/cron/test_cron_profile.py tests/test_hermes_constants.py tests/run_agent/test_strict_api_validation.py -> passed
• .venv\\Scripts\\python.exe -m py_compile hermes_constants.py hermes_cli/profiles.py hermes_cli/tips.py tools/environments/local.py tools/code_execution_tool.py agent/copilot_acp_client.py cron/scheduler.py tests/test_subprocess_home_isolation.py -> passed
• git diff --check -> passed

Note: the broader local Windows run that also included tests/tools/test_local_env_blocklist.py and all of tests/test_hermes_constants.py still has three environment/platform-specific failures unrelated to this diff: Homebrew PATH assertion on Windows, Windows native default Hermes root expectation, and symlink creation without Windows developer/admin privileges.