refactor(cli): quiet -Q session binding as a context manager

bind_quiet_session_key returned a (token, reset_fn) pair guarded by a
try/except around ContextVar.set (which cannot raise for a token produced
in the same frame) and an except-pass in the finally — the banned
dead-defense shape. It is now a @contextlib.contextmanager and
_run_quiet_single_query wraps the turn in a plain `with`, flattening the
double try nesting; the sys.exit(130) interrupt path still passes through
the reset.

cli.py

@@ -4091,12 +4091,7 @@ def _run_quiet_single_query(cli, effective_query):
 
     author = take_turn_author_from_env()
     author_kwargs = {"turn_author": author} if author is not None and _accepts_keyword(cli.agent.run_conversation, "turn_author") else {}
-    key_token, reset_session_key = None, None
-    try:
-        key_token, reset_session_key = bind_quiet_session_key(getattr(cli, "session_id", "") or "default")
-    except Exception:
-        key_token, reset_session_key = None, None
-    try:
+    with bind_quiet_session_key(getattr(cli, "session_id", "") or "default"):
         try:
             result = cli.agent.run_conversation(
                 user_message=effective_query, conversation_history=cli.conversation_history, **author_kwargs,
@@ -4133,12 +4128,6 @@ def _run_quiet_single_query(cli, effective_query):
             if isinstance(continued, dict):
                 result = continued
         response = result.get("final_response", "") if isinstance(result, dict) else str(result)
-    finally:
-        if key_token is not None and reset_session_key is not None:
-            try:
-                reset_session_key(key_token)
-            except Exception:
-                pass
     # Surface backend errors that produced no visible output (e.g. invalid model slug
     # -> provider 4xx) on stderr so piped stdout stays clean.
     if (

hermes_cli/quiet_single_query.py

@@ -10,6 +10,7 @@ was never injected as a follow-up.
 
 from __future__ import annotations
 
+import contextlib
 import time
 from typing import Any, Callable
 
@@ -17,12 +18,16 @@ from typing import Any, Callable
 _MAX_QUIET_NOTIFY_ROUNDS = 8
 
 
+@contextlib.contextmanager
 def bind_quiet_session_key(session_id: str):
-    """Bind the approval/session key to *this* quiet session, not an inherited parent env."""
+    """Bind the approval/session key to *this* quiet session for the enclosing ``with`` block."""
     from tools.approval_context import reset_current_session_key, set_current_session_key
 
     token = set_current_session_key(session_id or "default")
-    return token, reset_current_session_key
+    try:
+        yield
+    finally:
+        reset_current_session_key(token)
 
 
 def quiet_notify_linger_seconds() -> float: