feat: add optional Hermes negotiator bridge

[upsetbit]

Summary

• Add a safe-by-default Ralph Loop Hermes negotiator bridge script for Claude/Codex hook events
• Clarify that Hermes is a passive TUI unblocker, not a second active coding governor
• Document that Hermes should only do the minimum safe unblock action: answer blocking TUI prompts, retry after usage/rate limits, or handle max-iteration/restart handoffs so Codex/Ralph can keep running
• Add Claude settings and Codex notify fragments for optional hook configuration
• Document the executor/governor/Hermes negotiation flow and guardrails
• Add unittest coverage for attention classification, RALPH_DONE suppression, dedupe, and no-op behavior when no webhook is configured

Test Plan

• python3 -m unittest tests/test_hermes_bridge.py
• git diff --check
• Previous PR validation remains covered: py_compile, JSON/TOML parse checks, Markdown local-link check