feat(harness): add Hermes ACP adapter

[Osraka]

Refs #109

Summary

• Adds a Hermes harness-server adapter that starts hermes-acp, performs the ACP initialize/session handshake, reuses the native Hermes session id across turns, and normalizes ACP session/update events into Centaur canonical events.
• Wires hermes through HarnessKind, HarnessType, API/runtime sandbox command selection, the session CLI, integration wire-value coverage, and OpenRouter proxy fragment selection.
• Installs hermes-agent[acp]==0.17.0 in the sandbox image and preserves ~/.hermes under persistent sandbox state.
• Documents sandbox.harnessEngine=hermes, OPENROUTER_API_KEY, and HERMES_MODEL.

Context

This ports the earlier Hermes wrapper work from #142/#188 into the current Rust harness-server / api-rs path. #142 was closed with the suggestion to translate Hermes traces into Codex App Server format and port the work to the newer API/runtime layer.

Tests

• cargo test --offline --manifest-path crates/harness-server/Cargo.toml hermes -- --nocapture
• cargo test --offline --manifest-path services/api-rs/Cargo.toml -p centaur-session-core harness_type -- --nocapture
• cargo test --offline --manifest-path services/api-rs/Cargo.toml -p centaur-session-runtime codex_workload_pins_harness_via_container_args -- --nocapture
• cargo check --offline --manifest-path services/api-rs/Cargo.toml -p centaur-session-cli -p centaur-api-server -p centaur-api-integration-test
• git diff --check

Notes

I kept this as a draft because I could not run a full sandbox/Kubernetes Hermes E2E in this environment. The adapter follows Hermes 0.17 ACP distribution (hermes-agent[acp] / hermes-acp) and defaults provider routing to the existing OpenRouter fragment.