fix: restore base_url rstrip, extract should_clear_context_pin helper

Salvage follow-up for PR #68899:
- Restore .rstrip('/') on base_url in _swap_credential (both anthropic
  and OpenAI paths) to match every other assignment site. The route
  identity comparison still uses normalize_route_base_url which handles
  trailing slash correctly.
- Extract should_clear_context_pin() into hermes_cli/route_identity.py,
  consolidating 7 copy-pasted call sites across cli.py, gateway/run.py,
  gateway/slash_commands.py, and hermes_cli/model_switch.py into a
  single fail-closed helper.

C1 (anthropic path TLS re-application): pre-existing gap — the Anthropic
adapter (build_anthropic_client) has no TLS customization support at
all, so this is out of scope for this salvage.

hermes_cli/route_identity.py

@@ -45,3 +45,32 @@ def normalize_route_base_url(base_url: Any) -> str:
     if had_query_delimiter and not parsed.query:
         normalized += "?"
     return normalized
+
+
+def should_clear_context_pin(
+    configured_model: Any,
+    active_model: Any,
+    configured_base_url: Any,
+    active_base_url: Any,
+    configured_provider: Any,
+    active_provider: Any,
+) -> bool:
+    """True when a configured ``model.context_length`` pin no longer matches its runtime route.
+
+    Fail-closed: any error during route comparison returns ``True`` (drop the pin)
+    so a stale window never silently inflates the compression threshold.
+    """
+    configured_model = str(configured_model or "").strip()
+    if configured_model and configured_model != str(active_model or "").strip():
+        return True
+    try:
+        from agent.agent_init import _context_route_mismatch
+
+        return _context_route_mismatch(
+            configured_base_url,
+            active_base_url,
+            configured_provider,
+            active_provider,
+        )
+    except Exception:
+        return True