Build governed Hermes worker foundation

[CSandbatch]

What changed

• Added the typed TEI, workflow, and branded-contract foundation.
• Added provider authentication, Studio review resolution, and supporting tests.
• Added the Hermes-native repository constitution, nested AGENTS.md files, task loop, and hermes:doctor.
• Defined VS Code/Codex as the development surface and Hermes as the governed runtime operator.
• Added ADR-0011 for per-worker Hermes profiles with scoped skills, MCP tools, memory, sandbox, provider/model, and capability policy.
• Added a canonical project hub linking the repository, live site, implementation branch, commits, draft PR, documentation, and runtime guidance.
• Updated capability/provenance records, generated docs, site navigation, README, changelog, and CI.

Why

NovelGraph needs a trustworthy single-book path with explicit authority boundaries. Hermes worker profiles must be isolated and versioned; Hermes memory, skills, subagents, and MCP results cannot become canon. NovelGraph remains authoritative for TEI, graph state, approvals, provenance, sealed content, and export.

Validation

• corepack pnpm test
• corepack pnpm typecheck
• corepack pnpm build
• corepack pnpm lint
• corepack pnpm site:build
• corepack pnpm site:links
• corepack pnpm agent:test
• corepack pnpm hermes:doctor
• corepack pnpm capabilities:check
• corepack pnpm provenance:check
• corepack pnpm copy:lint

Hermes Agent 0.20.0 was installed and verified locally. Provider login and MCP configuration remain intentionally unset.