fix(hermes): expose plugins to launchd gateway

[furedea]

Summary

• leave mutable secretary credentials untouched by Home Manager
• backport the macOS launchd portion of fix(gateway): propagate HERMES_BUNDLED_* into launchd/systemd units NousResearch/hermes-agent#85365 at head commit 9c938204ba5f5bdf379ef9bb389a72841951447b
• propagate only allowlisted packaged resource paths into the generated launchd plist
• verify that a direct Python process using the generated launchd environment discovers the bundled Slack plugin
• keep the Slack gateway dependency import check

No credentials are copied into launchd, and Nix does not read or rewrite the local credential file.

Testing

• bats --print-output-on-failure tests/nix/hermes_secretary.bats (9 tests passed)
• nix flake check --print-build-logs
• nixfmt --check flake.nix nix/darwin/default.nix nix/home/default.nix
• shfmt -d tests/nix/hermes_secretary.bats
• statix check flake.nix
• statix check nix/home/default.nix
• deadnix --fail flake.nix nix/home/default.nix
• Apple plutil validation of the generated plist

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.