feat: add Hermes Agent install target

Adds `--platform hermes`, the first YAML-configured platform. Hermes Agent
reads `<HERMES_HOME>/config.yaml` (default `~/.hermes/config.yaml`) under
`mcp_servers`, so the installer gains a `yaml` format alongside `object`,
`array`, and `toml`.

That config is hand-edited and full of comments, ordering, and settings CRG
knows nothing about, so both install and uninstall edit it as text rather
than round-tripping it through a YAML dumper, which would reformat the whole
file. The parsed document is used only to decide whether an edit is needed
and to validate the result before writing; uninstall additionally diffs the
reparsed document against the expected one and refuses to write if any
unrelated setting moved.

Hermes' `mcp_servers` schema has no `cwd`, so the repo root is passed to the
server as `--repo <root>` in `args`, as is already done for OpenCode.

Skills are installed to `<HERMES_HOME>/skills/code-review-graph/<name>/SKILL.md`,
reusing `generate_skills` since Hermes uses the same frontmatter as Claude
Code. Hooks are not wired up: Hermes' hook model differs from the
settings.json shape used by Claude and Qoder, and MCP plus skills already
cover proactive graph use.

`_scope_for_config` now recognises a relocated `HERMES_HOME` as its own
user-scope boundary. Without this, install honoured the variable while
uninstall refused the resulting path as outside home/repo, writing a file it
could not clean up.

The `PLATFORMS`-driven uninstall test reaches whatever path each spec
resolves to. For every other platform that lands under a patched
`Path.home()`, but Hermes resolves an absolute path from the environment, so
conftest pins `HERMES_HOME` to a temp directory for the whole suite. Pinning
rather than clearing is deliberate: cleared, any test that forgets to patch
the home would silently rewrite the developer's real config.

Verified end to end against a real Hermes Agent install: `hermes mcp test`
connects and discovers 30 tools, `get_minimal_context_tool` returns graph
data through Hermes, and install followed by uninstall restores a 763-line
config byte for byte.