What does this PR do?

Aligns prefill_messages_file handling across Hermes entrypoints.

The canonical config key is top-level prefill_messages_file, as defined in the config schema and already documented by the environment/config docs. Before this PR, the entrypoints disagreed:

• classic CLI only read agent.prefill_messages_file
• gateway and cron only read top-level prefill_messages_file
• the godmode skill wrote agent.prefill_messages_file

That meant the same prefill config could work in one runtime and be silently ignored in another.

This PR makes top-level prefill_messages_file canonical while keeping agent.prefill_messages_file as a legacy read fallback. It also updates godmode to write the canonical key and clears both keys on undo.

Related Issue

Fixes #9635.

Supersedes the narrower CLI-only fixes in #9655 and #9872.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• cli.py: resolves prefill file paths from HERMES_PREFILL_MESSAGES_FILE, top-level prefill_messages_file, then legacy agent.prefill_messages_file.
• gateway/run.py: accepts legacy agent.prefill_messages_file when the canonical top-level key is absent.
• cron/scheduler.py: accepts legacy agent.prefill_messages_file when env/top-level config is absent.
• skills/red-teaming/godmode/scripts/auto_jailbreak.py: writes canonical top-level prefill_messages_file and removes legacy nested prefill state; undo clears both locations.
• Godmode docs and generated website/i18n copies now show the canonical top-level config key.
• Added regression coverage for CLI resolver precedence, gateway legacy fallback, gateway canonical-key precedence, and cron legacy fallback.

How to Test

1. Configure prefill_messages_file: prefill.json at the config root; CLI, gateway, and cron should all load it.
2. Configure legacy agent.prefill_messages_file: prefill.json; CLI, gateway, and cron should still load it as a fallback.
3. Configure both; the top-level key should win.
4. Run the focused checks listed below.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: WSL2 / Ubuntu

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Local validation:

• python -m py_compile cli.py gateway/run.py cron/scheduler.py skills/red-teaming/godmode/scripts/auto_jailbreak.py tests/cli/test_prefill_config.py tests/gateway/test_runtime_config_env_expansion.py tests/cron/test_scheduler.py -> passed
• git diff HEAD~1 --check -> passed
• rg -n -U "agent:\n\s+prefill_messages_file" skills website/docs website/i18n tests -S -> no matches

I did not run pytest locally. This checkout has a standing local restriction against pytest runs; the focused regression tests are included for CI.