feat(hermesagent): complete v0.19 configuration support

[rudironsoni]

Summary

• activate generated Hermes project plugins by merging plugins.enabled into
  $HERMES_HOME/config.yaml and setting
  HERMES_ENABLE_PROJECT_PLUGINS=true in $HERMES_HOME/.env
• preserve Hermes v0.19 native hook events, MCP OAuth/lifecycle fields, skill
  metadata, and native permission structures during generation and import
• make global command plugins resolve payloads relative to their installation,
  so custom HERMES_HOME profiles work
• fix project and global Hermes subagent import source paths and RuleSync
  destinations
• include Hermes activation writes in generation counts, dry-run output,
  --check, JSON output, and MCP results
• document the Hermes Agent v0.19.0 (v2026.7.20) compatibility contract

Project activation preserves unrelated user configuration and fails on an
explicit plugins.disabled conflict. Native-only Hermes hooks remain isolated
under hermesagent.hooks on import.

Refs #2342 and the v0.19 follow-up analysis in
#2342 (comment).

Runtime validation

Generated project and global fixtures were loaded through a clean checkout of
Hermes Agent v0.19.0 at commit
3ef6bbd201263d354fd83ec55b3c306ded2eb72a. The upstream loaders accepted:

• .hermes.md project context
• project and global rulesync-* plugins, including registered commands
• all configured native hook events against Hermes VALID_HOOKS
• stdio and HTTP MCP servers with OAuth and lifecycle fields
• native permission, approval, and website-block policies
• Hermes-native skill metadata

Both project and global RuleSync import round-trips passed from clean
directories. Project/global generation and --check also passed with isolated
HOME_DIR/HERMES_HOME values.

Repository validation

• pnpm run check
• pnpm run cicheck:content
• pnpm run docs:build
• pnpm run cspell
• git diff --check
• Hermes-focused unit tests: 50 passed
• Hermes command/subagent E2E suites: passed
• Hermes rules, ignore, checks, MCP, skills, hooks, and permissions E2E suites:
  passed
• full unit run: 7,529 passed; the unrelated Amp Bun Shell test could not run
  because bun is absent from PATH (spawn bun ENOENT)
• full E2E run: the existing convert dry-run assertion still fails because it
  expects [DRY RUN] on stdout but receives an empty string; all Hermes suites
  pass

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Thank you for your contribution! Unfortunately, this PR has 1509 added lines, which exceeds the limit of 1000 lines for external contributors.

Please split your changes into smaller PRs. See CONTRIBUTING.md for details.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[dyoshikawa]

I found one merge-blocking security issue and two correctness gaps. The current CI checks are green, but normal project generation would persistently remove Hermes's project-plugin trust boundary for every future repository. Please address that before merging and fix the profile path described inline. The MCP integration also remains incomplete: the Hermes factory still declares supportsEnabledTools and supportsDisabledTools as false, so McpProcessor strips those fields before the adapter can produce tools.include and tools.exclude; please update the metadata and add processor/E2E coverage.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[dyoshikawa]

@rudironsoni Thank you!