fix: sanitize chat payloads and provider precedence

[teknium1]

Summary

• salvage the substantive fixes from fix: sanitize chat payloads and provider precedence #903 onto current main
• preserve Adavya Sharma's authored commits for the payload sanitization + test additions
• keep the provider precedence fix so saved config provider wins over stale env overrides
• keep the checkpoint test lock swap for sandboxed CI
• omit the stale top-level skills-config rename because current main already uses hermes skills config
• add a tiny follow-up docstring clarification for the updated provider precedence

Contributor credit

This PR salvages the substantive work from #903 by @adavyas and preserves their authored commits where applicable.

Test plan

• source /home/teknium/.hermes/hermes-agent/.venv/bin/activate
• python -m pytest tests/test_provider_parity.py tests/test_runtime_provider_resolution.py tests/test_cli_provider_resolution.py tests/test_batch_runner_checkpoint.py -n0 -q
• python -m hermes_cli.main --help
• python -m hermes_cli.main skills config --help

Notes

• Fixes Strict OpenAI-compatible chat completions endpoints reject replayed tool_calls.call_id / response_item_id fields #893
• Supersedes fix: sanitize chat payloads and provider precedence #903 without carrying forward the stale redundant command-surface rename
  EOF; __hermes_rc=$?; printf 'HERMES_FENCE_a9f7b3'; exit $__hermes_rc