Guard public surface registry

[kriptoburak]

Summary

• Add registry hygiene coverage for normalized public surface entries
• Update the reviewed Hermes Agent plugins.py source lock to 8d1e3ca

Validation

• uv run ruff format scripts/check_hermes_agent_compat.py scripts/public_surfaces.py tests/test_public_surfaces.py
• uv run ruff format --check scripts/check_hermes_agent_compat.py scripts/public_surfaces.py tests/test_public_surfaces.py
• uv run ruff check scripts/check_hermes_agent_compat.py scripts/public_surfaces.py tests/test_public_surfaces.py
• uv run pytest tests/test_public_surfaces.py tests/test_hermes_agent_compat.py
• uv run python scripts/check_hermes_agent_compat.py
• uv run ruff format --check .
• uv run ruff check .
• uv run basedpyright
• uv run pytest --cov=hermes_tweet --cov=tests --cov-report=term-missing --cov-fail-under=100
• uv run bandit -q -r hermes_tweet scripts
• uv run python scripts/check_public_safety.py
• uv run pip-audit
• uv run python scripts/check_public_links.py
• uv build
• uv run twine check dist/*
• actionlint
• git diff --check

Note

Add validation tests to guard PUBLIC_SURFACE_FILES path normalization

• Adds a new test in test_public_surfaces.py that asserts every entry in PUBLIC_SURFACE_FILES is a relative path with no ./ prefix or .. traversal components.
• Updates the expected SHA for hermes_cli/plugins.py in check_hermes_agent_compat.py to reflect the current state of that file.

^{Macroscope summarized 8f948a1.}