fix(tests): runtime_provider no longer permanently captures a mocked load_config

Test-pollution class: runtime_provider is usually imported lazily (inside
switch_model's resolution path), so its first import in a pytest worker can
happen while a test has hermes_cli.config.load_config patched. The
module-level from-import then bound the MagicMock permanently — after the
patch exited, every later caller in the process silently read the dead
test's config. Live victim: MoA aggregator context-length resolution
(resolve_runtime_provider -> AuthError 'Unknown provider custom:example'),
making TestMoAContextLength::test_moa_custom_context_configures_compressor_threshold
fail whenever it shared a process with
TestLocalOllamaModelDiscovery::test_switch_model_on_current_ollama_custom_endpoint_keeps_base_url.

Fix: load_config / get_compatible_custom_providers / normalize_extra_headers
become late-bound delegates resolving hermes_cli.config attributes at call
time. Both patch targets (config.load_config and
runtime_provider.load_config) keep working. Regression tests pin the
late-binding property and fail if the delegates revert to from-imports
(sabotage-verified).

hermes_cli/runtime_provider.py

@@ -40,14 +40,36 @@ from hermes_cli.auth import (
     is_actual_local_base_url,
     normalize_actual_base_url,
 )
-from hermes_cli.config import (
-    get_compatible_custom_providers,
-    load_config,
-    normalize_extra_headers,
-)
+from hermes_cli import config as _config_mod
 from hermes_cli.providers import custom_provider_aliases, custom_provider_slug
 from hermes_constants import OPENROUTER_BASE_URL
 from hermes_cli.providers import is_official_openai_host
+
+
+def load_config():
+    """Late-bound delegate to :func:`hermes_cli.config.load_config`.
+
+    Deliberately NOT a module-level ``from hermes_cli.config import
+    load_config``: this module is often imported lazily (inside functions),
+    so its first import can happen while a test has
+    ``hermes_cli.config.load_config`` patched — a from-import would then
+    bind the MagicMock *permanently*, poisoning every later caller in the
+    process (the mock's fixed config shadows the real one long after the
+    patch exits). Delegating at call time keeps both patch targets working:
+    patching ``hermes_cli.config.load_config`` OR
+    ``hermes_cli.runtime_provider.load_config`` behaves as expected.
+    """
+    return _config_mod.load_config()
+
+
+def get_compatible_custom_providers(config=None):
+    """Late-bound delegate — see :func:`load_config` for why."""
+    return _config_mod.get_compatible_custom_providers(config)
+
+
+def normalize_extra_headers(value):
+    """Late-bound delegate — see :func:`load_config` for why."""
+    return _config_mod.normalize_extra_headers(value)
 from utils import base_url_host_matches, base_url_hostname, env_int