Fix Hermes plugin rollback safety

[vxcozy]

What changed

v0.3.3 fixed active-profile selection, but recovery could still make a failed setup worse. Louder Bridge could remove the new plugin before the previous copy was safely back in place, or leave Hermes enabled after deleting its files. Recovery now keeps the last complete owned plugin directory and restores the matching config. If either side cannot be verified, it fails without deleting the working copy.

Uninstall also stops editing plugin arrays by numeric index. It calls hermes plugins disable louder-bridge, leaves the expected disabled entry, and lets reinstall clear it through the normal enable path. That protects unrelated plugins when their list order changes.

Hermes Agent 0.19.0 still performs plugins disable as a non-atomic read/modify/write. A separate config write that lands inside that command can still be overwritten. Removing that last race requires an atomic remove-by-value or compare-and-swap operation in Hermes itself.

Checks

• I ran npm test (391 tests passed).
• I ran npm run authorship:check.
• I ran npm run security:check.
• I ran npm run release:check.
• I tested affected hardware behavior on a Codex Micro, or explained why that was not possible.
• If MIC behavior changed, I tested every affected app or terminal agent on a Codex Micro and recorded the connection type. MIC behavior did not change.
• I ran /humanizer on documentation, release notes, app text, CLI output, and other public writing changed by this pull request.
• I removed private paths, tokens, session IDs, and project names from logs and examples.
• The commits and pull request contain no automated authorship credit or authorship trailers.

Compatibility

Verified on macOS 26.6.1 with Node.js 22.23.1, Hermes Agent 0.19.0, and Louder Bridge 0.3.3 source. The regression suite uses isolated temporary Hermes homes and covers install, update, uninstall, concurrent config edits, and failed filesystem recovery.

No physical Codex Micro run was needed because this change does not touch device input, firmware, connection handling, MIC behavior, or terminal integration. Existing Hermes profiles and the installed app were not used or modified.

Post-deploy validation

On the first install, update, and uninstall with Hermes 0.19:

• Confirm unrelated plugins.enabled and plugins.disabled entries stay unchanged.
• Confirm uninstall leaves louder-bridge disabled and reinstall clears that entry.
• Confirm any interrupted rollback leaves either the previous or new owned plugin at the active path, never enabled config pointing at a missing managed directory.
• Watch for could not be fully rolled back, configuration changed during setup, managed Hermes plugin is missing, and settings changed during rollback.

Stop rollout and revert this change if an unrelated plugin entry changes or Hermes points at a missing managed plugin. The maintainer owns this check through the first full install/update/uninstall cycle after merge. This local setup path has no separate runtime dashboard.