feat: support subscription-backed providers (Codex, Copilot) for Paperclip agents

[citadelgrad]

Summary

Enable Paperclip-managed Hermes agents to run against subscription-backed inference providers like OpenAI Codex Plus/Pro and GitHub Copilot.

Two changes are needed to make this work end-to-end:

1. buildHermesConfig accepts an explicit provider. Persisted when the Paperclip create-form passes one (validated against VALID_PROVIDERS). Downstream forms can extend CreateConfigValues to expose a Provider selector; we accept it via duck-typing so the base type doesn't need to change. When no provider is set, the existing runtime chain still applies (~/.hermes/config.yaml → model-prefix inference → "auto").

2. Fix the child-env corruption bug that made subscription providers unusable. Paperclip stores per-agent env vars in a structured-secret shape:

   { type: "plain" | "secret" | "env", value: "..." }
   

   The previous `Object.assign(env, userEnv)` serialized those wrappers to `"[object Object]"`, so a common pattern like `adapterConfig.env.HOME = "/Users/"` caused the spawned hermes to see `HOME="[object Object]"`, fail to read `~/.hermes/config.yaml`, and trip the first-run guard:

   It looks like Hermes isn't configured yet — no API keys or providers found.

   New `coerceEnvValue()` helper unwraps the wrapper shape and drops empty/invalid entries before merging into the spawn env.

Bumps `0.3.0` → `0.3.1`.

Test plan

• Reproduced the failure on a real Paperclip agent with `adapterConfig.env.HOME` set as a `{type, value}` secret.
• After patch + `npm run build`, the same agent runs successfully under `provider=openai-codex` resolved from `adapterConfig`: `[hermes] Starting Hermes Agent (model=…, provider=openai-codex [adapterConfig], …)` → exit 0, real work performed end-to-end.
• `npm run build` (tsc) clean.

Notes

The repo doesn't currently have a unit-test runner. Happy to add tests for `coerceEnvValue` and the provider passthrough if you'd like — just let me know your preferred framework (or whether you'd prefer a zero-dep `node --test` file).