feat: add Hermes Agent memory provider

[antas-marcin]

What

Adds a second integration to the repo: a Hermes Agent memory provider backed by Weaviate Engram, alongside the existing Claude Code plugin (plugin/, unchanged). First step toward making this repo the home of all Engram integrations (à la mem0's integrations/).

How it works

Implements Hermes' MemoryProvider ABC (the plugins/memory/<name>/ contract):

• Recall — on_turn_start/queue_prefetch run a background memories.search on the current prompt; prefetch() joins it briefly (≤3s) and injects the results as bullet-form context. The agent can also search on demand via tool.
• Store — sync_turn() ships each completed turn via memories.add in a daemon thread (never blocks a response), tagged with the session_id scope property; skipped for non-primary agent contexts (subagent/cron/flush).
• Tools — engram_search (semantic recall) and engram_add (explicit fact storage).
• Mirroring — on_memory_write() mirrors Hermes' built-in MEMORY.md/USER.md add/replace writes into Engram. remove is intentionally not propagated (Engram is append-only from this provider).
• Identity — config user_id → gateway-native id → git config user.email. Deliberately no shared fallback: a non-unique id would commingle different users' memories.
• Fail-open — missing key/identity or API errors disable memory without breaking the session; a circuit breaker pauses API calls after 5 consecutive failures.

Install

hermes/install.sh auto-detects the right target:

• $HERMES_HOME/plugins/engram/ — user-installed providers (survives hermes update), preferred when the installed Hermes supports it;
• <checkout>/plugins/memory/engram/ — bundled fallback for older versions (--bundled to force, --link for development).

The provider package (hermes/engram/) is self-contained — no repo-local imports — so it can be dropped into a NousResearch/hermes-agent PR unchanged.

Testing

• 29 unit tests (hermes/tests/) — Hermes ABC, hermes_constants, and the Engram SDK stubbed; the provider is loaded by file path mirroring Hermes' own discovery, so the suite doubles as a drop-in compatibility check.
• New CI workflow (.github/workflows/test.yml) — syntax checks + the test suite on Python 3.11/3.12.
• Manually verified against a real Hermes install: discover_memory_providers() lists engram, and load_memory_provider("engram") returns the provider with both tools registered.

Follow-ups (Phase 2, not in this PR)

• Upstream PR to NousResearch/hermes-agent
• Expanded CI (integration tests against a real Engram project, Claude-plugin tests, multi-OS matrix)
• cli.py (hermes engram status, …), on_session_end/on_pre_compress hooks

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   1   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

🛡️ The following SAST misconfigurations have been detected

	NAME	FILE
	Security Risks of Using the Subprocess Module	...s/engram/__init__.py	View in code