Strip stale agent config keys on Hermes save

[kevinhermawan]

Summary

Saving agent configs in Hermes fails with repeated AJV "must NOT have additional properties" errors when the stored JSON still uses pre-regrouping flat keys (data-collection, query-analysis, and any agent whose registry schema uses additionalProperties: false). Invoke-time Zod already strips unknown keys for some agents; Hermes save did not.

Scope

• In scope: strip config to the declared JSON Schema shape before AJV validation and DB write on agent config create/update; SchemaForm default merge drops unknown top-level keys; tests and data-collection README note.
• Out of scope: flat-to-grouped field migration maps; pipeline step inline config validation (can follow up).

Acceptance criteria

• Saving an agent config whose JSON still contains legacy flat top-level keys succeeds after strip (no additional-properties spam).
• Stored config contains only keys allowed by the current registry schema.
• Unit tests cover strip of flat data-collection-shaped keys and nested unknown fields.
• SchemaForm applySchemaDefaults does not retain undeclared top-level keys.

Notes

• Refs merged regroup work (Group and default data-collection config for Hermes #573 data-collection, Group and default query-analysis config for Hermes #579 query-analysis). Operators may need to re-enter tuning that lived only under removed flat keys; strip does not remap values.