SUB-192: reach Hermes v2.0.3 outcome parity

[Pavel-Tk]

Summary

• reach Hermes v2.0.3 outcome parity with Codex-native MCP and lifecycle integration
• add hosted device onboarding, private credential custody, canonical quality-v2 recall, durable WAL queue/retry, truthful writes/status, and direct-human consented app-server history replay
• package 11 MCP tools and six initially-untrusted hooks: SessionStart, UserPromptSubmit, PostToolUse, Stop, PreCompact, SessionEnd
• add exact-commit deterministic build/provenance and protected release workflow

Validation

• Ruff and compileall: pass
• pytest: 158 passed
• official Codex plugin validator: pass
• public scanner: 85 files, no findings
• src/substrate_capture/ byte-identical to origin/main
• deterministic double-build SHA-256: 9890d0eea93909082fed53e304341b65ba999350df26b5f5375fce8570766d91
• clean Codex 0.147.0 artifact install: 11 tools, six initially-untrusted hooks, real visible prompt/tool/assistant/SessionEnd capture, WAL verified

Required review

One adversarial round completed. All critical findings were fixed: atomic history preparation, durable replay leases, owner-only Windows ACLs, direct-human consent, commit-bound provenance, canonical identity consistency. The final requirement audit found no remaining critical implementation gaps; fixes were not re-reviewed per policy.

Boundaries

• no TOML editing, pasted API key, or global notify replacement
• memory only; no connected-system actions or permission claims
• release remains unpublished until the server PR is deployed and live hosted certification passes

Linear: SUB-192