Guard public surface text files

[kriptoburak]

Summary

• add regression coverage that every registered public surface is readable as UTF-8 text
• reject accidental NUL-bearing public surfaces before link or safety scans rely on them

Validation

• uv run ruff format tests/test_public_surfaces.py
• uv run ruff format --check tests/test_public_surfaces.py
• uv run ruff check tests/test_public_surfaces.py
• uv run pytest tests/test_public_surfaces.py
• uv run ruff format --check .
• uv run ruff check .
• uv run basedpyright
• uv run pytest --cov=hermes_tweet --cov=tests --cov-report=term-missing --cov-fail-under=100
• uv run bandit -q -r hermes_tweet scripts
• uv run python scripts/check_public_safety.py
• uv run pip-audit
• uv run python scripts/check_public_links.py
• uv run python scripts/check_hermes_agent_compat.py
• uv build
• uv run twine check dist/*
• actionlint
• git diff --check

Note

Add test to guard public surface files against non-UTF-8 content and NUL bytes

Adds test_public_surface_registry_files_are_utf8_text in test_public_surfaces.py, which reads each file listed in public_surfaces.PUBLIC_SURFACE_FILES as UTF-8 and asserts no NUL (\x00) characters are present. The test suite now fails if any listed public surface file is not valid UTF-8 or contains a NUL byte.

^{Macroscope summarized 5794e5f.}