SUB-185: bring Claude Code to Hermes v2.0.3 parity

[Pavel-Tk]

Summary

• rebuild Claude Code memory integration against the authoritative Hermes v2.0.3 behavior, not Codex
• add fixed-origin, direct-human RFC 8628 onboarding and private credential custody
• make capture primary-only, durable, restart-safe, and strictly capability-gated
• use prompt-bound canonical recall and the five Hermes wiki operations
• add real Claude Code 2.1.237 install/update/rollback/uninstall support
• add deterministic, commit-bound release assets and protected publication gates

Authority and provenance

• Hermes release: v2.0.3 / e4ad07cfc858618edfd69e1f3be5e8345b253037
• Hermes current main: db4ddc2f093f833ffa62f4246860de96ba398713
• Claude base: 2a5051304ac7e8b960e3cdd9d4d2e96dcba76b80
• Candidate: caf722cd51be5e6e46cce2e371d3e5239c94c6d1

Validation

• Python 3.11: 249 passed, 3 platform/full-gate skips
• Python 3.12: 249 passed, 3 platform/full-gate skips
• explicit 50 MiB MCP SIGKILL/restart: passed
• POSIX process-tree cleanup: passed
• actual isolated Claude Code 2.1.237 install/MCP/update/rollback/uninstall: passed
• Ruff, format, compileall, Node syntax, public scanner, deterministic builds: passed

Candidate artifact SHA-256:

• ZIP fe625fb89a4351fe5a886094deaff92add63e8379077776579d8321717aef0b7
• installer e72eed007c9433eaf93d476150ed4fb3fce1fd8cec0c488c42969037a03763e1
• SHA256SUMS f9e5a2238b2eb2366f429e7344170419f3ea3980e94554e8d8c8f37794035295

Release status

Do not release from this PR. Publication remains blocked until:

1. server client substrate-claude-code is merged and deployed;
2. hosted Windows/macOS/Linux checks and full-continuation pass and become required;
3. exact merged-main live hosted certification passes;
4. a human approves the protected release environment.

No connected-system actions or authorization claims are added.

Linear: SUB-185