refactor(cli): class-level disabled_toolsets default instead of per-site getattr

Inspection surfaces run on partially built HermesCLI instances (tests use
HermesCLI.__new__), so the attribute needs a default; declare it once on
the class next to _seeded_first_message rather than getattr at five sites.

cli.py

@@ -2531,6 +2531,8 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin, CLITuiMix
     # Seeded -q first message (see _should_seed_interactive); run() re-creates
     # _pending_input, so it is enqueued only after the fresh queue exists.
     _seeded_first_message: Optional["_SeededQueryMessage"] = None
+    # Inspection surfaces (banner, /tools, status line) read this on partially built instances too.
+    disabled_toolsets: Optional[List[str]] = None
 
     def __init__(
         self,