feat(install): onboard Hermes with the selected ClawRouter signer

[A1igator]

Summary

• add tenjin install --harness hermes --wallet-provider clawrouter as the explicit one-step path for reusing ClawRouter's canonical EVM signer
• preserve the native Hermes MCP/plugin integration without creating or funding a second wallet
• keep wallet management outside MCP so agents cannot create, inspect, switch, or send from wallets through the MCP surface
• write an owner-only, secret-redacted install receipt and keep surfacing its notice until a separate acknowledgement command is run
• record feat(wallet): safely reuse ClawRouter signer and spend limits #118's effective ClawRouter/Tenjin spend-policy source, imported limits, read-only external-policy boundary, and separate-ledger warning in that receipt

Authority, custody, and spend policy

--wallet-provider clawrouter is an explicit provider-selection action; detection alone never adopts that wallet. The private key necessarily enters Tenjin process memory while connecting and signing, but Tenjin does not copy it into Tenjin storage, persist it, log it, return it, transmit it, inspect the mnemonic, or request raw-transaction signing.

With no explicit Tenjin read-spend setting, #118 reads ClawRouter's configured perRequest, rolling hourly, rolling daily, and session limits as Tenjin defaults. Tenjin never writes ClawRouter's policy/history and uses its own atomic ledger, so this is not an aggregate cross-application budget. Setting any Tenjin read-spend key selects the separate Tenjin policy as a whole and is honored for Tenjin purchases.

An unrestricted same-OS-user/YOLO agent is outside Tenjin's application-level containment. The preflight, receipt, and pending notice provide visibility and audit state; they do not prove human presence or approval. Installation, wallet replacement, configuration changes, and permission changes remain outside MCP and the recommended command allowlist.

Receipt and notice contract

• write ~/.tenjin/install-receipt.json atomically with mode 0600
• record CLI version, harnesses, execution state, wallet/custody facts, effective publish mode, effective spend-policy source and limits, changed paths, warnings, undo commands, and notice state
• record externalPolicyMutationByTenjin: none, ledger: separate-tenjin, and aggregateWithClawRouter: false
• redact private keys and known secret environment assignments before persistence
• keep notice state unacknowledged; install success, TTY presence, or agent execution never becomes proof of acknowledgement
• surface the pending notice in later interactive output, JSON output, and tenjin doctor
• add tenjin notice acknowledge <id> while retaining acknowledgementProven: false
• avoid a separate Hermes policy profile or TENJIN_HARNESS; Hermes uses the effective provider-aware Tenjin policy

Stack

This PR is stacked on critical #118 and rebuilt on its current head. It consumes #118's custody/spend-policy facts and the native Hermes integration inherited through #113. #120 only previews and forwards this install result.

Verification

• formatting, lint, typecheck, and build pass
• 260 focused install/receipt/buy/policy/ledger tests pass on the restacked head
• the full stacked suite passes apart from the loopback-restricted eval inside the sandbox; that eval passes outside the sandbox

A funded Base USDC purchase/publication smoke was not performed.

Priority

High (P1).

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[A1igator]

Refreshed this stack onto the current #118 head in b919bbb and resolved the installer, permissions, tests, and documentation overlaps. Verification is green: typecheck, lint, build, 250 focused tests, and the full suite (1,740 passed / 10 skipped).

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[A1igator]

Merged the current #118 head (9a170bb7) into this branch at c5ad2d7 and resolved the README overlap by preserving both #118's ClawRouter custody/non-containment disclosure and this PR's Hermes one-step onboarding command.

Validated the committed merge in an isolated worktree: full suite 1,740 passed / 10 skipped, plus typecheck, lint, Prettier, build, and git diff --check. GitHub now reports the PR mergeable and clean. Unrelated uncommitted work in the existing branch worktree was left untouched.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[A1igator]

Closing as deferred. The ClawRouter-backed Hermes onboarding is no longer justified by the current routing economics. Follow-up criteria and recovery notes are tracked in #122; #120 has been rebuilt without this dependency.