Fixes #5436. Also addresses #5451 (provider runtime health observability).

Summary

Adds a process-scoped provider cooldown tracker (circuit breaker) and runtime health observability.

1. Provider cooldown / circuit breaker

Problem: When a provider returns 401/403/429, Hermes retries then possibly falls back, but on the next iteration it hits the same broken provider again with no memory of prior failures.

Introduces agent/provider_cooldown.py with:

• CooldownEntry dataclass tracking error count, cooldown expiry, failure reason
• ProviderCooldownTracker (thread-safe singleton) with escalating backoff:
  • Transient errors (rate_limit, overloaded, auth): 30s → 60s → 5min
  • Permanent errors (auth_permanent, billing): 5min → 10min → 30min
• Circuit breaker semantics: record_failure() opens/escalates, record_success() closes

Integration: checked before each API call → fallback or wait. Reset on success.

2. Provider health observability

Extends the tracker with ProviderHealthStats:

• Tracks per-provider success count, error count, average latency, last error reason
• get_health_summary() returns a compact dict suitable for /status display
• Health stats survive cooldown expiry (session-scoped)
• Latency captured from actual API call timing

Independent of #5441 (P0 error classification) — uses plain string reason codes.

Tests

63 tests covering escalating backoff, circuit close on success, thread safety, expired auto-clear, singleton pattern, health stats accumulation/persistence/filtering, and diagnostics.