refactor(codex): one shared constant for the hermes-tools MCP server name

The name of Hermes' MCP callback for the codex app-server runtime was spelled
as a string literal in five places (the server itself, the runtime migration
that writes `[mcp_servers.hermes-tools]`, the Kanban worker override launcher,
the elicitation auto-accept handler, the display-name stripper and the switch
report) and had already drifted once (#111707). Define it once in
agent/transports/hermes_tools_mcp_server.py — the module that IS the server and
whose module-level imports are stdlib only, so every higher layer (transports,
agent/codex_runtime, hermes_cli) can import it without a cycle — and read it
everywhere.

Two invariant tests in tests/agent/transports/: the worker's `-c
mcp_servers.<name>.env.*` overrides only ever target an entry the migration
really writes to config.toml (red on the pre-fix base: `{'hermes-mcp'}`), and
non-owned launches emit no override at all.

Refs #111707

hermes_cli/codex_runtime_plugin_migration.py

@@ -9,6 +9,8 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Optional
 
+from agent.transports.hermes_tools_mcp_server import HERMES_TOOLS_MCP_SERVER_NAME
+
 logger = logging.getLogger(__name__)
 
 
@@ -425,9 +427,9 @@ def migrate(
     if default_permission_profile:
         report.wrote_permissions_default = default_permission_profile
     if expose_hermes_tools:
-        translated["hermes-tools"] = _build_hermes_tools_mcp_entry()
-        if "hermes-tools" not in report.migrated:
-            report.migrated.append("hermes-tools")
+        translated[HERMES_TOOLS_MCP_SERVER_NAME] = _build_hermes_tools_mcp_entry()
+        if HERMES_TOOLS_MCP_SERVER_NAME not in report.migrated:
+            report.migrated.append(HERMES_TOOLS_MCP_SERVER_NAME)
     managed_block = render_codex_toml_section(
         translated, plugins=plugins, default_permission_profile=default_permission_profile)
     new_text = managed_block

hermes_cli/codex_runtime_switch.py

@@ -88,10 +88,10 @@ def _migration_lines(config: dict) -> list[str]:
     """Run the ~/.codex/config.toml migration and describe it; failures are non-fatal."""
     lines: list[str] = []
     try:
-        from hermes_cli.codex_runtime_plugin_migration import migrate
+        from hermes_cli.codex_runtime_plugin_migration import HERMES_TOOLS_MCP_SERVER_NAME, migrate
         mig_report = migrate(config)
         # The hermes-tools callback is internal plumbing — surfaced separately below.
-        user_servers = [s for s in mig_report.migrated if s != "hermes-tools"]
+        user_servers = [s for s in mig_report.migrated if s != HERMES_TOOLS_MCP_SERVER_NAME]
         if user_servers:
             lines.append(f"Migrated {len(user_servers)} MCP server(s): {', '.join(user_servers)}")
         if mig_report.migrated_plugins:
@@ -104,7 +104,7 @@ def _migration_lines(config: dict) -> list[str]:
             lines.append(
                 f"Default sandbox: {mig_report.wrote_permissions_default} "
                 f"(no approval prompt on every write)")
-        if "hermes-tools" in mig_report.migrated:
+        if HERMES_TOOLS_MCP_SERVER_NAME in mig_report.migrated:
             lines.extend(_HERMES_TOOLS_CALLBACK_NOTE)
         lines.append(f"  (config: {mig_report.target_path})")
         for err in mig_report.errors: