Add native Hermes v0.20 review integration

[mauricemohr88-debug]

Summary

• add a native Hermes v0.20 directory-plugin manifest and root loader while preserving the existing PyPI/CLI path
• register hermes plugin-guard operator commands plus one narrow plugin_guard_review_candidate model tool
• restrict model reviews to exact, disabled Hermes plugin roots and reject separate memory, cron-scheduler, and model-provider activation paths
• scan a private snapshot in a single resource-bounded worker, including runtime-capable directories normally ignored by the general CLI
• return only bounded rule/severity data, HMAC-based opaque locations, and bounded line/count metadata

Security boundary

This remains a static review aid, not a safety verdict or admission gate. Hermes v0.20 has no third-party lifecycle hook that can enforce policy across install, update, enable, and load. The implementation does not import or execute target plugin code.

Validation

• ruff check .
• ruff format --check .
• pytest -q — 162 passed
• wheel and sdist build; twine check passed
• clean-wheel CLI and native worker smoke tests passed
• exact Hermes v0.20 tag v2026.8.3 / commit 3c27eb6: tool and CLI registered, zero hooks/middleware
• 70,000-line eval adversarial case rejected in about 0.1 s at about 28 MB RSS
• independent security re-review: GO, no open publish blockers